@plurnk/plurnk-service 1.16.4 → 1.17.0

package/migrations/001_schema.sql

@@ -1,2207 +0,0 @@
--- MIGRATE: 1 baseline
--- The single current pre-release schema baseline. Shape changes replace it;
--- existing development databases are deleted and recreated, never upgraded.
-
--- workspaces
--- project_root: workspace pointer. NULL = headless (no disk side-effects);
--- non-null = absolute path to the client's source tree, supplied at
--- workspace.create or workspace.set_root.
-CREATE TABLE IF NOT EXISTS workspaces (
-    id                        INTEGER NOT NULL PRIMARY KEY,
-    version                   INTEGER NOT NULL DEFAULT 0 CHECK (version >= 0),
-    name                      TEXT    NOT NULL UNIQUE CHECK (length(name) > 0),
-    created_at                TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    project_root              TEXT,
-    -- {§operator-config} validated client workspace settings; each field composes
-    -- with operator configuration at its owning use site.
-    settings                  TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(settings))
-) STRICT;
-
-CREATE INDEX IF NOT EXISTS workspaces_created_at ON workspaces (created_at);
-
--- model_routes — the immutable resolved model route ({§worker-model-selection}). One row per
--- complete resolved tuple; append-only. Alias is provenance plus a tuning scope,
--- not route identity, and is absent on a direct provider/model selection.
-CREATE TABLE IF NOT EXISTS model_routes (
-    id         INTEGER NOT NULL PRIMARY KEY,
-    alias      TEXT             CHECK (alias IS NULL OR length(alias) > 0),
-    provider   TEXT    NOT NULL CHECK (length(provider) > 0),
-    model      TEXT    NOT NULL CHECK (length(model) > 0),
-    base_url   TEXT             CHECK (base_url IS NULL OR length(base_url) > 0),
-    created_at TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
-) STRICT;
-
-CREATE UNIQUE INDEX IF NOT EXISTS model_routes_identity
-ON model_routes (coalesce(alias, ''), provider, model, coalesce(base_url, ''));
-
--- workers
-CREATE TABLE IF NOT EXISTS workers (
-    id              INTEGER NOT NULL PRIMARY KEY,
-    version         INTEGER NOT NULL DEFAULT 0 CHECK (version >= 0),
-    workspace_id    INTEGER NOT NULL,
-    name            TEXT    NOT NULL CHECK (length(name) > 0),
-    created_at      TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    -- {§worker-provider-identity}: provider affinity must not collide when
-    -- independent databases reuse local integer ids.
-    provider_identity TEXT NOT NULL DEFAULT (lower(hex(randomblob(16))))
-        CHECK (length(provider_identity) = 32 AND provider_identity NOT GLOB '*[^0-9a-f]*'),
-    -- {§worker-model-selection}: the worker's durable resolved model, NULL for non-model
-    -- workers or a deliberately modelless unresolved worker. spawn_model_route_id is the
-    -- persistent spawn override; NULL means "use my model."
-    model_route_id       INTEGER          REFERENCES model_routes(id),
-    spawn_model_route_id INTEGER          REFERENCES model_routes(id),
-    -- {§worker-reasoning-policy}: nullable only while the worker has no model;
-    -- once selected, model and reasoning policy form one durable generation policy.
-    reasoning_policy TEXT CHECK (reasoning_policy IS NULL OR length(reasoning_policy) > 0),
-    -- workers fork via parent_worker_id; workspaces carry no parent — {§machine-processes-no-fork-workspace}
-    parent_worker_id INTEGER          CHECK (parent_worker_id IS NULL OR parent_worker_id != id),
-    origin          TEXT    NOT NULL DEFAULT 'client' CHECK (origin IN ('model', 'client', '_plurnk')),
-    -- {§methods-model-worker}: durable identity for the workspace's stable
-    -- default conversation; unrelated to its human-facing, reclaimable name.
-    default_conversation INTEGER NOT NULL DEFAULT 0 CHECK (default_conversation IN (0, 1)),
-    -- {§worker-settings}: the worker's own behavioral rules inside the workspace's
-    -- world — the workspace is how things are; each worker carries the rules its
-    -- loops obey. Client-declared at worker creation, mutable between loops,
-    -- validated at the client-input boundary (closed known-key set; unknown keys
-    -- never persist).
-    settings TEXT NOT NULL DEFAULT '{}' CHECK (json_valid(settings)),
-    -- Parent-derived capability ceiling, copied by value at child creation.
-    -- Root workers have the unrestricted empty policy.
-    capability_bound TEXT NOT NULL DEFAULT '{}' CHECK (json_valid(capability_bound)),
-    -- {§env-delta-log-pull}: monotonic observation progress, not a private world snapshot.
-    -- Creation captures the workspace high-water; a fork instead copies its
-    -- parent's cursor and records the closed event boundary of its snapshot.
-    ambient_event_cursor INTEGER      CHECK (ambient_event_cursor IS NULL OR ambient_event_cursor >= 0),
-    fork_event_boundary INTEGER       CHECK (fork_event_boundary IS NULL OR fork_event_boundary >= 0),
-    CHECK (fork_event_boundary IS NULL OR parent_worker_id IS NOT NULL),
-    CHECK (default_conversation = 0 OR (origin = 'model' AND parent_worker_id IS NULL)),
-    CHECK ((model_route_id IS NULL) = (reasoning_policy IS NULL)),
-    FOREIGN KEY (workspace_id)    REFERENCES workspaces(id) ON DELETE CASCADE,
-    FOREIGN KEY (parent_worker_id) REFERENCES workers(id)     ON DELETE CASCADE
-) STRICT;
-
-CREATE        INDEX IF NOT EXISTS workers_workspace_id_created_at ON workers (workspace_id, created_at);
-CREATE        INDEX IF NOT EXISTS workers_parent_worker_id         ON workers (parent_worker_id);
-CREATE UNIQUE INDEX IF NOT EXISTS workers_provider_identity         ON workers (provider_identity);
-CREATE UNIQUE INDEX IF NOT EXISTS workers_workspace_default_conversation
-    ON workers (workspace_id) WHERE default_conversation = 1;
--- NOT unique: a name is frozen per worker ({§machine-processes-worker-origin}) but RECLAIMABLE across
--- time — a terminated worker keeps its name in permanent history while a fresh spawn reuses it;
--- worker_resolve_by_name picks the newest. A LIVE collision is refused at the spawn gate (Worker.edit
--- → worker_live_by_name → 409), never by this index. Indexed for the by-name resolve/spawn lookup.
-CREATE        INDEX IF NOT EXISTS workers_workspace_name          ON workers (workspace_id, name);
-
-CREATE TRIGGER IF NOT EXISTS workers_provider_identity_immutable
-BEFORE UPDATE OF provider_identity ON workers
-WHEN NEW.provider_identity != OLD.provider_identity
-BEGIN
-    SELECT RAISE(ABORT, 'workers.provider_identity is immutable');
-END;
-
-CREATE TRIGGER IF NOT EXISTS workers_fork_event_boundary_immutable
-BEFORE UPDATE OF fork_event_boundary ON workers
-WHEN NEW.fork_event_boundary IS NOT OLD.fork_event_boundary
-BEGIN
-    SELECT RAISE(ABORT, 'workers.fork_event_boundary is immutable');
-END;
-
--- {§module-worker-state}: one opaque, provider-validated JSON snapshot per
--- module owner and Worker. Core owns isolation, inheritance, and lifecycle;
--- the module owns its state schema and semantics.
-CREATE TABLE IF NOT EXISTS worker_module_state (
-    worker_id         INTEGER NOT NULL,
-    namespace_owner  TEXT    NOT NULL CHECK (length(namespace_owner) > 0),
-    state             TEXT    NOT NULL CHECK (json_valid(state)),
-    updated_at        TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    PRIMARY KEY (worker_id, namespace_owner),
-    FOREIGN KEY (worker_id) REFERENCES workers(id) ON DELETE CASCADE
-) STRICT;
-
--- A child snapshots every initialized module state at birth. Later parent
--- mutations do not propagate; the child and parent are independent authorities.
-CREATE TRIGGER IF NOT EXISTS worker_module_state_inherit
-AFTER INSERT ON workers
-WHEN NEW.parent_worker_id IS NOT NULL
-BEGIN
-    INSERT INTO worker_module_state (worker_id, namespace_owner, state, updated_at)
-    SELECT NEW.id, namespace_owner, state, updated_at
-    FROM worker_module_state
-    WHERE worker_id = NEW.parent_worker_id;
-END;
-
--- {§env-delta-log-pull}: one append-only occurrence journal gives every
--- producer a shared monotonic order. Audience is structural: direct parent,
--- explicit workspace broadcast, or their union. The event snapshots exactly
--- what an observer row needs because source-log curation cannot erase history.
--- source_record_id is forensic identity for the originating log/loop row, not a
--- foreign key: model log curation must not erase an already-recorded occurrence.
-CREATE TABLE IF NOT EXISTS ambient_events (
-    id                      INTEGER NOT NULL PRIMARY KEY,
-    workspace_id            INTEGER NOT NULL,
-    producer_worker_id      INTEGER NOT NULL,
-    target_parent_worker_id INTEGER,
-    workspace_broadcast     INTEGER NOT NULL DEFAULT 0 CHECK (workspace_broadcast IN (0, 1)),
-    kind                    TEXT    NOT NULL CHECK (kind IN ('activity', 'loop_termination')),
-    source_record_id        INTEGER NOT NULL CHECK (source_record_id >= 1),
-    at                      TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    source                  TEXT,
-    op                      TEXT    NOT NULL,
-    delimiter               TEXT    NOT NULL DEFAULT '',
-    signal                  TEXT             CHECK (signal IS NULL OR json_valid(signal)),
-    scheme                  TEXT,
-    username                TEXT,
-    password                TEXT,
-    hostname                TEXT,
-    port                    INTEGER          CHECK (port IS NULL OR (port BETWEEN 0 AND 65535)),
-    pathname                TEXT,
-    query                   TEXT,
-    fragment                TEXT,
-    line_marker             TEXT             CHECK (line_marker IS NULL OR json_valid(line_marker)),
-    tx                      TEXT    NOT NULL,
-    mimetype_tx             TEXT    NOT NULL CHECK (length(mimetype_tx) > 0),
-    rx                      TEXT    NOT NULL,
-    mimetype_rx             TEXT    NOT NULL CHECK (length(mimetype_rx) > 0),
-    status_rx               INTEGER NOT NULL CHECK (status_rx BETWEEN 100 AND 599),
-    state                   TEXT    NOT NULL CHECK (state IN ('resolved', 'failed', 'cancelled')),
-    outcome                 TEXT,
-    attrs                   TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(attrs)),
-    terminated_by           TEXT             CHECK (terminated_by IS NULL OR terminated_by = 'cancel'),
-    created_at              TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    CHECK (target_parent_worker_id IS NOT NULL OR workspace_broadcast = 1),
-    CHECK (
-        (kind = 'activity' AND terminated_by IS NULL)
-        OR
-        (kind = 'loop_termination'
-            AND op = 'SEND'
-            AND scheme = 'worker'
-            AND json_valid(rx)
-            AND json_type(rx) = 'object'
-            AND json_type(rx, '$.status') = 'integer'
-            AND json_extract(rx, '$.status') = status_rx)
-    ),
-    FOREIGN KEY (workspace_id)            REFERENCES workspaces(id) ON DELETE CASCADE,
-    FOREIGN KEY (producer_worker_id)      REFERENCES workers(id)    ON DELETE CASCADE,
-    FOREIGN KEY (target_parent_worker_id) REFERENCES workers(id)    ON DELETE CASCADE
-) STRICT;
-
-CREATE INDEX IF NOT EXISTS ambient_events_workspace_id_id
-    ON ambient_events (workspace_id, id);
-CREATE INDEX IF NOT EXISTS ambient_events_producer_kind_id
-    ON ambient_events (producer_worker_id, kind, id);
-CREATE INDEX IF NOT EXISTS ambient_events_parent_id
-    ON ambient_events (target_parent_worker_id, id)
-    WHERE target_parent_worker_id IS NOT NULL;
-CREATE UNIQUE INDEX IF NOT EXISTS ambient_events_source_identity
-    ON ambient_events (producer_worker_id, kind, source_record_id);
-
-CREATE TRIGGER IF NOT EXISTS ambient_events_structural_audience
-BEFORE INSERT ON ambient_events
-WHEN NOT EXISTS (
-    SELECT 1
-    FROM workers producer
-    WHERE producer.id = NEW.producer_worker_id
-      AND producer.workspace_id = NEW.workspace_id
-      AND (
-          NEW.target_parent_worker_id IS NULL
-          OR NEW.target_parent_worker_id = producer.parent_worker_id
-      )
-)
-BEGIN
-    SELECT RAISE(ABORT, 'ambient event audience must be the producer direct parent in the same workspace');
-END;
-
--- A worker begins after the history that predates its existence. This trigger
--- runs in the worker INSERT statement, so an occurrence is either in the
--- baseline or after it. Fork INSERTs supply their own cursor/boundary and skip
--- this ordinary-worker baseline. {§env-delta-log-pull}
-CREATE TRIGGER IF NOT EXISTS workers_capture_ambient_baseline
-AFTER INSERT ON workers
-WHEN NEW.ambient_event_cursor IS NULL
-BEGIN
-    UPDATE workers
-    SET ambient_event_cursor = COALESCE((
-        SELECT MAX(ae.id) FROM ambient_events ae WHERE ae.workspace_id = NEW.workspace_id
-    ), 0)
-    WHERE id = NEW.id;
-END;
-
--- loops
--- policy: complete immutable per-loop capability attenuation and proposal
--- disposition ({§loop-policy-effective-read}).
-CREATE TABLE IF NOT EXISTS loops (
-    id       INTEGER NOT NULL PRIMARY KEY,
-    version  INTEGER NOT NULL DEFAULT 0   CHECK (version >= 0),
-    worker_id   INTEGER NOT NULL,
-    sequence INTEGER NOT NULL             CHECK (sequence >= 1),
-    status   INTEGER NOT NULL DEFAULT 102 CHECK (status IN (100, 102, 200, 202, 413, 429, 499, 500, 504, 508)),
-    prompt   TEXT    NOT NULL,
-    -- {§prompt-causal-source}: canonical actor address for the initial prompt;
-    -- NULL means the owning worker itself.
-    prompt_source TEXT CHECK (prompt_source IS NULL OR length(prompt_source) > 0),
-    policy   TEXT    NOT NULL DEFAULT '{"capabilities":{},"proposals":"review"}' CHECK (json_valid(policy)),
-    -- {§worker-model-selection}: immutable loop snapshots of the resolved model route and the
-    -- effective spawn route (was provider_spec/child_provider_spec JSON).
-    model_route_id       INTEGER          REFERENCES model_routes(id),
-    spawn_model_route_id INTEGER          REFERENCES model_routes(id),
-    reasoning_policy TEXT CHECK (reasoning_policy IS NULL OR length(reasoning_policy) > 0),
-    max_turns INTEGER NOT NULL DEFAULT 50 CHECK (max_turns >= -1),
-    -- {§methods-loop-run-open-paths}: the initial prompt frame's selected paths,
-    -- held here until turn 1 materializes that frame (string[] JSON).
-    open_paths TEXT NOT NULL DEFAULT '[]' CHECK (json_valid(open_paths)),
-    -- {§prompt-loop-containment}: one queued recovery loop may carry the
-    -- complete orphan frame set of one concluded source loop.
-    orphan_source_loop_id INTEGER,
-    -- {§worker-scheme} loop-termination delta: terminated_at is stamped by the trigger
-    -- below when status crosses into terminal (every death-path, uniformly).
-    terminated_at    TEXT,
-    terminal_result  TEXT,
-    -- {§loop-terminal-authorship}: 'cancel' names an external loop.cancel;
-    -- NULL covers model terminals and engine verdicts whose result carries the story.
-    terminated_by    TEXT                      CHECK (terminated_by IS NULL OR terminated_by = 'cancel'),
-    CONSTRAINT loops_generation_policy_contract CHECK (
-        (model_route_id IS NULL) = (reasoning_policy IS NULL)
-    ),
-    CONSTRAINT loops_terminal_result_contract CHECK (
-        CASE
-            WHEN status IN (100, 102, 202) THEN terminal_result IS NULL
-            WHEN terminal_result IS NULL OR NOT json_valid(terminal_result) THEN 0
-            ELSE
-                json_type(terminal_result) IS 'object'
-                AND json_type(terminal_result, '$.status') IS 'integer'
-                AND (
-                    json_extract(terminal_result, '$.status') = status
-                    OR (
-                        status = 200
-                        AND json_extract(terminal_result, '$.status') BETWEEN 200 AND 399
-                        AND json_extract(terminal_result, '$.status') != 202
-                    )
-                    OR (
-                        status = 500
-                        AND json_extract(terminal_result, '$.status') BETWEEN 400 AND 599
-                    )
-                )
-                AND CASE
-                    WHEN json_extract(terminal_result, '$.status') < 400 THEN
-                        json_type(terminal_result, '$.problem') IS NULL
-                    ELSE
-                        json_type(terminal_result, '$.problem') IS 'object'
-                        AND json_type(terminal_result, '$.problem.status') IS 'integer'
-                        AND json_extract(terminal_result, '$.problem.status')
-                            = json_extract(terminal_result, '$.status')
-                        AND json_type(terminal_result, '$.problem.type') IS 'text'
-                        AND length(json_extract(terminal_result, '$.problem.type')) > 0
-                        AND json_type(terminal_result, '$.problem.title') IS 'text'
-                        AND length(json_extract(terminal_result, '$.problem.title')) > 0
-                        AND json_type(terminal_result, '$.problem.detail') IS 'text'
-                        AND length(json_extract(terminal_result, '$.problem.detail')) > 0
-                        AND json_type(terminal_result, '$.problem.instance') IS 'text'
-                        AND length(json_extract(terminal_result, '$.problem.instance')) > 0
-                END
-        END
-    ),
-    FOREIGN KEY (worker_id) REFERENCES workers(id) ON DELETE CASCADE,
-    FOREIGN KEY (orphan_source_loop_id) REFERENCES loops(id)
-) STRICT;
-
-CREATE UNIQUE INDEX IF NOT EXISTS loops_worker_id_sequence ON loops (worker_id, sequence);
-CREATE UNIQUE INDEX IF NOT EXISTS loops_orphan_source_loop_id ON loops (orphan_source_loop_id);
--- {§worker-scheme}: a loop crossing into a terminal status stamps terminated_at, so sibling
--- workers pull the termination as a folded ambient delta — caught uniformly across every
--- death-path (SEND, overflow recovery, max-turns, strike, KILL). The stamp updates terminated_at,
--- never status, so it cannot re-fire this trigger. Terminals: 200 done · 413 budget ·
--- 429 turn-ceiling · 499 cancel · 500 fail · 504 wall-clock timeout · 508 runaway. (202 = parked/sleeping, NOT terminal.)
-CREATE TRIGGER IF NOT EXISTS loops_stamp_terminated_at
-AFTER UPDATE OF status ON loops
-WHEN NEW.status IN (200, 413, 429, 499, 500, 504, 508) AND OLD.status NOT IN (200, 413, 429, 499, 500, 504, 508)
-BEGIN
-    UPDATE loops SET terminated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = NEW.id;
-END;
-
--- A child terminal transition is an occurrence addressed only to its direct
--- parent. Directly inserted fork history never crosses this transition and
--- therefore cannot fabricate a new conclusion event.
-CREATE TRIGGER IF NOT EXISTS loops_append_ambient_event
-AFTER UPDATE OF status ON loops
-WHEN NEW.status IN (200, 413, 429, 499, 500, 504, 508) AND OLD.status NOT IN (200, 413, 429, 499, 500, 504, 508)
-BEGIN
-    INSERT INTO ambient_events (
-        workspace_id, producer_worker_id, target_parent_worker_id,
-        workspace_broadcast, kind, source_record_id, source,
-        op, delimiter, scheme, pathname,
-        tx, mimetype_tx, rx, mimetype_rx, status_rx, state, terminated_by
-    )
-    SELECT w.workspace_id, NEW.worker_id, w.parent_worker_id,
-           0, 'loop_termination', NEW.id, NULL,
-           'SEND', '', 'worker', '/' || w.name,
-           '', 'text/plain', NEW.terminal_result, 'application/json',
-           json_extract(NEW.terminal_result, '$.status'), 'resolved', NEW.terminated_by
-    FROM workers w
-    WHERE w.id = NEW.worker_id
-      AND w.parent_worker_id IS NOT NULL
-      -- A loop whose only turns are client-driven operation turns is not the parent's
-      -- business (#323). A loop that never got a turn at all — a spawn refused before it
-      -- ran, e.g. a branch batch failing git-preflight — is, or the parent waits on a
-      -- ghost that vanished from Active Child Workers without a word (#385).
-      AND (
-          NOT EXISTS (SELECT 1 FROM turns t WHERE t.loop_id = NEW.id)
-          OR EXISTS (
-              SELECT 1
-              FROM turns t
-              WHERE t.loop_id = NEW.id
-                AND NOT (t.producer = '_plurnk' AND t.kind = 'operation')
-          )
-      );
-END;
-
--- turns
--- finish_reason / model: accepted provider-call metadata from the provider
--- response contract. Physical request accounting is normalized beneath the
--- logical emission attempt that caused it.
-CREATE TABLE IF NOT EXISTS turns (
-    id               INTEGER NOT NULL PRIMARY KEY,
-    version          INTEGER NOT NULL DEFAULT 0 CHECK (version >= 0),
-    loop_id          INTEGER NOT NULL,
-    sequence         INTEGER NOT NULL           CHECK (sequence >= 1),
-    timestamp        TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    -- {§turn-record}: producer and purpose define the turn. Packet/provider
-    -- evidence below is an optional inference specialization.
-    producer         TEXT    NOT NULL           CHECK (producer IN ('model', 'client', '_plurnk', 'plugin')),
-    kind             TEXT    NOT NULL           CHECK (kind IN ('inference', 'initialization', 'overflow', 'operation', 'maintenance')),
-    status           INTEGER NOT NULL           CHECK (status BETWEEN 100 AND 599),
-    -- NULL while the producer still owns this turn. Status 102 is both the
-    -- provisional running value and the exact completed continue disposition;
-    -- completed_at distinguishes those states without inventing another status.
-    completed_at     TEXT DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    -- Provider-derived curation calibration for this turn; NULL when input
-    -- capacity is unknown. {§tokenomics-client-gauge}
-    usage_curation_budget INTEGER                CHECK (usage_curation_budget IS NULL OR usage_curation_budget >= 1),
-    -- {§packet-stored-shape}: NULL means no model request was assembled. A
-    -- present packet is either the measured request or that request extended
-    -- by the paired admitted-response fields.
-    packet           TEXT                       CHECK (
-        CASE
-            WHEN packet IS NULL THEN 1
-            WHEN json_valid(packet) = 0 THEN 0
-            ELSE COALESCE(
-                json_type(packet) = 'object'
-                AND json_type(packet, '$.weight') = 'integer'
-                AND json_extract(packet, '$.weight') >= 0
-                AND json_type(packet, '$.sections') = 'array'
-                AND json_type(packet, '$.attributions') = 'array'
-                AND (
-                    (
-                        json_type(packet, '$.assistant') IS NULL
-                        AND json_type(packet, '$.assistantRaw') IS NULL
-                    )
-                    OR (
-                        json_type(packet, '$.assistant') = 'object'
-                        AND json_type(packet, '$.assistant.content') = 'text'
-                        AND json_type(packet, '$.assistant.ops') = 'array'
-                        AND json_type(packet, '$.assistant.reasoning') IN ('text', 'null')
-                        AND json_type(packet, '$.assistantRaw') IS NOT NULL
-                    )
-                ),
-                0
-            )
-        END
-    ),
-    finish_reason    TEXT,
-    model            TEXT                       CHECK (model IS NULL OR length(model) >= 1),
-    -- Opaque provider→client metadata plus engine rail keys; absent outside
-    -- recorded inference evidence. {§meta-passthrough}, {§rail-truth-engine-verdict}
-    meta             TEXT                       CHECK (meta IS NULL OR json_valid(meta)),
-    CHECK (completed_at IS NOT NULL OR status = 102),
-    CHECK ((producer = 'model') = (kind = 'inference')),
-    CHECK (kind NOT IN ('initialization', 'overflow') OR producer = '_plurnk'),
-    CHECK (
-        kind = 'inference'
-        OR (
-            usage_curation_budget IS NULL
-            AND packet IS NULL
-            AND finish_reason IS NULL
-            AND model IS NULL
-            AND meta IS NULL
-        )
-    ),
-    FOREIGN KEY (loop_id) REFERENCES loops(id) ON DELETE CASCADE
-) STRICT;
-
-CREATE UNIQUE INDEX IF NOT EXISTS turns_loop_id_sequence ON turns (loop_id, sequence);
-CREATE        INDEX IF NOT EXISTS turns_timestamp        ON turns (timestamp);
-
--- Producer and purpose are immutable except for the single pre-inference
--- diversion into overflow recovery. The transition is allowed only before any
--- model or non-kernel evidence exists.
-CREATE TRIGGER IF NOT EXISTS turns_identity_forward_only
-BEFORE UPDATE OF producer, kind ON turns
-WHEN NOT (
-    OLD.producer = NEW.producer
-    AND OLD.kind = NEW.kind
-)
-AND NOT (
-    OLD.producer = 'model'
-    AND OLD.kind = 'inference'
-    AND NEW.producer = '_plurnk'
-    AND NEW.kind = 'overflow'
-    AND OLD.completed_at IS NULL
-    AND OLD.packet IS NULL
-    AND OLD.usage_curation_budget IS NULL
-    AND OLD.finish_reason IS NULL
-    AND OLD.model IS NULL
-    AND OLD.meta IS NULL
-    -- Engine-side embedding calls are not model history; only an emission or BARE call is.
-    AND NOT EXISTS (SELECT 1 FROM inference_calls WHERE turn_id = OLD.id AND kind IN ('emission', 'bare'))
-    AND NOT EXISTS (
-        SELECT 1 FROM log_entries
-        WHERE turn_id = OLD.id AND origin != '_plurnk'
-    )
-)
-BEGIN
-    SELECT RAISE(ABORT, 'turn producer and kind are immutable outside pre-inference overflow diversion');
-END;
-
--- One logical inference occurrence. Workspace ownership is mandatory; a real
--- causal turn is attached when one exists. Generation and embedding evidence
--- specialize this identity without duplicating its lifecycle or physical
--- request ledger. {§tokenomics-provider-usage}
-CREATE TABLE IF NOT EXISTS inference_calls (
-    id               INTEGER NOT NULL PRIMARY KEY,
-    workspace_id     INTEGER NOT NULL,
-    turn_id          INTEGER,
-    sequence         INTEGER NOT NULL CHECK (sequence >= 1),
-    kind             TEXT    NOT NULL CHECK (kind IN ('emission', 'bare', 'embedding_query', 'embedding_documents')),
-    state            TEXT    NOT NULL DEFAULT 'pending' CHECK (state IN ('pending', 'response', 'error')),
-    -- Exact opaque tag set forwarded with generation calls. Embeddings carry
-    -- the empty set through the same general identity.
-    attributions     TEXT    NOT NULL DEFAULT '[]' CHECK (
-        json_valid(attributions) AND json_type(attributions) = 'array'
-    ),
-    request_model    TEXT    NOT NULL CHECK (length(request_model) >= 1),
-    timestamp        TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    completed_at     TEXT,
-    CHECK (
-        (state = 'pending' AND completed_at IS NULL)
-        OR (state IN ('response', 'error') AND completed_at IS NOT NULL)
-    ),
-    CHECK (
-        kind IN ('emission', 'bare') OR json_array_length(attributions) = 0
-    ),
-    FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE,
-    FOREIGN KEY (turn_id) REFERENCES turns(id) ON DELETE CASCADE
-) STRICT;
-
-CREATE UNIQUE INDEX IF NOT EXISTS inference_calls_turn_sequence
-    ON inference_calls (turn_id, sequence) WHERE turn_id IS NOT NULL;
-CREATE UNIQUE INDEX IF NOT EXISTS inference_calls_workspace_sequence
-    ON inference_calls (workspace_id, sequence) WHERE turn_id IS NULL;
-CREATE INDEX IF NOT EXISTS inference_calls_workspace_id
-    ON inference_calls (workspace_id, timestamp, id);
-
-CREATE TRIGGER IF NOT EXISTS inference_calls_open_pending
-BEFORE INSERT ON inference_calls
-WHEN NEW.state != 'pending' OR NEW.completed_at IS NOT NULL
-BEGIN
-    SELECT RAISE(ABORT, 'inference call must open pending');
-END;
-
-CREATE TRIGGER IF NOT EXISTS inference_calls_context_valid
-BEFORE INSERT ON inference_calls
-WHEN NOT (
-    (NEW.turn_id IS NULL AND NEW.kind IN ('embedding_query', 'embedding_documents'))
-    OR
-    (NEW.turn_id IS NOT NULL
-        AND COALESCE((
-            SELECT w.workspace_id = NEW.workspace_id
-            FROM turns t
-            JOIN loops l ON l.id = t.loop_id
-            JOIN workers w ON w.id = l.worker_id
-            WHERE t.id = NEW.turn_id
-        ), 0) = 1
-        AND (
-            NEW.kind IN ('embedding_query', 'embedding_documents')
-            OR COALESCE((
-                SELECT producer = 'model' AND kind = 'inference'
-                FROM turns
-                WHERE id = NEW.turn_id
-            ), 0) = 1
-        )
-    )
-)
-BEGIN
-    SELECT RAISE(ABORT, 'inference call requires a valid owning workspace and causal context');
-END;
-
-CREATE TRIGGER IF NOT EXISTS inference_calls_request_identity_immutable
-BEFORE UPDATE OF workspace_id, turn_id, sequence, kind, attributions, request_model, timestamp
-ON inference_calls
-BEGIN
-    SELECT RAISE(ABORT, 'inference call request identity is immutable');
-END;
-
-CREATE TRIGGER IF NOT EXISTS inference_calls_state_forward_only
-BEFORE UPDATE OF state ON inference_calls
-WHEN NOT (
-    NEW.state = OLD.state
-    OR (OLD.state = 'pending' AND NEW.state IN ('response', 'error'))
-)
-BEGIN
-    SELECT RAISE(ABORT, 'inference call state may only close once');
-END;
-
-CREATE TRIGGER IF NOT EXISTS inference_calls_terminal_evidence_required
-BEFORE UPDATE OF state ON inference_calls
-WHEN NEW.state != OLD.state
- AND NOT (
-    (NEW.state = 'response' AND (
-        (NEW.kind IN ('emission', 'bare') AND EXISTS (
-            SELECT 1 FROM model_calls WHERE id = NEW.id AND response IS NOT NULL
-        ))
-        OR
-        (NEW.kind IN ('embedding_query', 'embedding_documents') AND EXISTS (
-            SELECT 1 FROM embedding_calls WHERE id = NEW.id AND output_count IS NOT NULL
-        ))
-    ))
-    OR
-    (NEW.state = 'error' AND (
-        (NEW.kind IN ('emission', 'bare') AND EXISTS (
-            SELECT 1 FROM model_calls WHERE id = NEW.id AND failure IS NOT NULL
-        ))
-        OR
-        (NEW.kind IN ('embedding_query', 'embedding_documents') AND EXISTS (
-            SELECT 1 FROM embedding_calls WHERE id = NEW.id AND failure IS NOT NULL
-        ))
-    ))
- )
-BEGIN
-    SELECT RAISE(ABORT, 'inference call terminal state requires specialization evidence');
-END;
-
-CREATE TRIGGER IF NOT EXISTS inference_calls_completion_immutable
-BEFORE UPDATE OF completed_at ON inference_calls
-WHEN OLD.state != 'pending'
-BEGIN
-    SELECT RAISE(ABORT, 'inference call completion is immutable');
-END;
-
--- Generation-specific response/failure evidence. The request model and
--- lifecycle remain on inference_calls; response_model is provider evidence.
-CREATE TABLE IF NOT EXISTS model_calls (
-    id               INTEGER NOT NULL PRIMARY KEY,
-    -- {§packet-attachment-parts}: exact model-facing log coordinates whose
-    -- native bytes were present in this completed request. The ordinary READ
-    -- result remains independently durable in the log.
-    native_inputs    TEXT    NOT NULL DEFAULT '[]' CHECK (
-        json_valid(native_inputs) AND json_type(native_inputs) = 'array'
-    ),
-    response         TEXT             CHECK (response IS NULL OR json_valid(response)),
-    failure          TEXT             CHECK (failure IS NULL OR json_valid(failure)),
-    capacity         TEXT             CHECK (
-        capacity IS NULL OR (json_valid(capacity) AND json_type(capacity) = 'object')
-    ),
-    finish_reason    TEXT,
-    response_model   TEXT             CHECK (response_model IS NULL OR length(response_model) >= 1),
-    CHECK (response IS NULL OR (capacity IS NOT NULL AND response_model IS NOT NULL)),
-    CHECK (json_array_length(native_inputs) = 0 OR response IS NOT NULL),
-    FOREIGN KEY (id) REFERENCES inference_calls(id) ON DELETE CASCADE
-) STRICT;
-
-CREATE TRIGGER IF NOT EXISTS model_calls_specializes_generation
-BEFORE INSERT ON model_calls
-WHEN COALESCE((
-    SELECT kind IN ('emission', 'bare') FROM inference_calls WHERE id = NEW.id
-), 0) != 1
-BEGIN
-    SELECT RAISE(ABORT, 'model call must specialize a generation inference');
-END;
-
-CREATE TRIGGER IF NOT EXISTS model_calls_cannot_orphan_inference
-AFTER DELETE ON model_calls
-WHEN EXISTS (SELECT 1 FROM inference_calls WHERE id = OLD.id)
-BEGIN
-    SELECT RAISE(ABORT, 'model call specialization cannot be deleted independently');
-END;
-
-CREATE TRIGGER IF NOT EXISTS inference_calls_create_model_specialization
-AFTER INSERT ON inference_calls
-WHEN NEW.kind IN ('emission', 'bare')
-BEGIN
-    INSERT INTO model_calls (id) VALUES (NEW.id);
-END;
-
-CREATE TRIGGER IF NOT EXISTS model_calls_observation_pending
-BEFORE UPDATE OF native_inputs, response, failure, capacity, finish_reason, response_model
-ON model_calls
-WHEN COALESCE((SELECT state FROM inference_calls WHERE id = OLD.id), '') != 'pending'
-BEGIN
-    SELECT RAISE(ABORT, 'model call observation is immutable');
-END;
-
-CREATE TRIGGER IF NOT EXISTS model_calls_close_response
-AFTER UPDATE OF response ON model_calls
-WHEN NEW.response IS NOT NULL
-BEGIN
-    UPDATE inference_calls
-    SET state = 'response', completed_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-    WHERE id = NEW.id AND state = 'pending';
-END;
-
-CREATE TRIGGER IF NOT EXISTS model_calls_close_error
-AFTER UPDATE OF failure ON model_calls
-WHEN NEW.failure IS NOT NULL AND NEW.response IS NULL
-BEGIN
-    UPDATE inference_calls
-    SET state = 'error', completed_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-    WHERE id = NEW.id AND state = 'pending';
-END;
-
--- Embedding-specific cardinality and artifact evidence. input_count is
--- prepared before physical I/O; output_count or failure closes the shared call.
-CREATE TABLE IF NOT EXISTS embedding_calls (
-    id               INTEGER NOT NULL PRIMARY KEY,
-    input_count      INTEGER          CHECK (input_count IS NULL OR input_count >= 0),
-    output_count     INTEGER          CHECK (output_count IS NULL OR output_count >= 0),
-    metadata         TEXT             CHECK (
-        metadata IS NULL OR (json_valid(metadata) AND json_type(metadata) = 'object')
-    ),
-    failure          TEXT             CHECK (failure IS NULL OR json_valid(failure)),
-    CHECK (output_count IS NULL OR (input_count IS NOT NULL AND output_count = input_count AND metadata IS NOT NULL)),
-    CHECK (NOT (output_count IS NOT NULL AND failure IS NOT NULL)),
-    FOREIGN KEY (id) REFERENCES inference_calls(id) ON DELETE CASCADE
-) STRICT;
-
-CREATE TRIGGER IF NOT EXISTS embedding_calls_specializes_embedding
-BEFORE INSERT ON embedding_calls
-WHEN COALESCE((
-    SELECT kind IN ('embedding_query', 'embedding_documents')
-    FROM inference_calls
-    WHERE id = NEW.id
-), 0) != 1
-BEGIN
-    SELECT RAISE(ABORT, 'embedding call must specialize an embedding inference');
-END;
-
-CREATE TRIGGER IF NOT EXISTS embedding_calls_cannot_orphan_inference
-AFTER DELETE ON embedding_calls
-WHEN EXISTS (SELECT 1 FROM inference_calls WHERE id = OLD.id)
-BEGIN
-    SELECT RAISE(ABORT, 'embedding call specialization cannot be deleted independently');
-END;
-
-CREATE TRIGGER IF NOT EXISTS inference_calls_create_embedding_specialization
-AFTER INSERT ON inference_calls
-WHEN NEW.kind IN ('embedding_query', 'embedding_documents')
-BEGIN
-    INSERT INTO embedding_calls (id) VALUES (NEW.id);
-END;
-
-CREATE TRIGGER IF NOT EXISTS embedding_calls_observation_pending
-BEFORE UPDATE OF input_count, output_count, metadata, failure ON embedding_calls
-WHEN COALESCE((SELECT state FROM inference_calls WHERE id = OLD.id), '') != 'pending'
-BEGIN
-    SELECT RAISE(ABORT, 'embedding call observation is immutable');
-END;
-
-CREATE TRIGGER IF NOT EXISTS embedding_calls_input_once
-BEFORE UPDATE OF input_count ON embedding_calls
-WHEN OLD.input_count IS NOT NULL
-BEGIN
-    SELECT RAISE(ABORT, 'embedding call input cardinality is immutable');
-END;
-
-CREATE TRIGGER IF NOT EXISTS embedding_calls_close_response
-AFTER UPDATE OF output_count ON embedding_calls
-WHEN NEW.output_count IS NOT NULL
-BEGIN
-    UPDATE inference_calls
-    SET state = 'response', completed_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-    WHERE id = NEW.id AND state = 'pending';
-END;
-
-CREATE TRIGGER IF NOT EXISTS embedding_calls_close_error
-AFTER UPDATE OF failure ON embedding_calls
-WHEN NEW.failure IS NOT NULL
-BEGIN
-    UPDATE inference_calls
-    SET state = 'error', completed_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-    WHERE id = NEW.id AND state = 'pending';
-END;
-
--- Emission admission specializes one model call without re-owning its response,
--- provider identity, ordering, or accounting evidence.
-CREATE TABLE IF NOT EXISTS turn_attempts (
-    id               INTEGER NOT NULL PRIMARY KEY,
-    model_call_id    INTEGER NOT NULL UNIQUE,
-    accepted         INTEGER          CHECK (accepted IS NULL OR accepted IN (0, 1)),
-    parse_errors     TEXT    NOT NULL DEFAULT '[]' CHECK (
-        json_valid(parse_errors) AND json_type(parse_errors) = 'array'
-    ),
-    FOREIGN KEY (model_call_id) REFERENCES model_calls(id) ON DELETE CASCADE
-) STRICT;
-
-CREATE TRIGGER IF NOT EXISTS turn_attempts_request_identity_immutable
-BEFORE UPDATE OF model_call_id ON turn_attempts
-BEGIN
-    SELECT RAISE(ABORT, 'emission attempt identity is immutable');
-END;
-
-CREATE TRIGGER IF NOT EXISTS turn_attempts_emission_call_only
-BEFORE INSERT ON turn_attempts
-WHEN COALESCE((SELECT kind = 'emission' FROM inference_calls WHERE id = NEW.model_call_id), 0) != 1
-BEGIN
-    SELECT RAISE(ABORT, 'turn attempt requires an emission model call');
-END;
-
-CREATE TRIGGER IF NOT EXISTS turn_attempts_classification_after_response
-BEFORE UPDATE OF accepted, parse_errors ON turn_attempts
-WHEN COALESCE((SELECT state = 'response' FROM inference_calls WHERE id = OLD.model_call_id), 0) != 1
-BEGIN
-    SELECT RAISE(ABORT, 'emission classification requires model response evidence');
-END;
-
-CREATE TRIGGER IF NOT EXISTS turn_attempts_classification_once
-BEFORE UPDATE OF accepted, parse_errors
-ON turn_attempts
-WHEN OLD.accepted IS NOT NULL
-BEGIN
-    SELECT RAISE(ABORT, 'emission attempt classification is immutable');
-END;
-
-CREATE TRIGGER IF NOT EXISTS turn_attempts_one_accepted_insert
-BEFORE INSERT ON turn_attempts
-WHEN NEW.accepted = 1 AND EXISTS (
-    SELECT 1
-    FROM turn_attempts existing
-    JOIN inference_calls old_call ON old_call.id = existing.model_call_id
-    JOIN inference_calls new_call ON new_call.id = NEW.model_call_id
-    WHERE old_call.turn_id = new_call.turn_id AND existing.accepted = 1
-)
-BEGIN
-    SELECT RAISE(ABORT, 'one emission may be accepted per turn');
-END;
-
-CREATE TRIGGER IF NOT EXISTS turn_attempts_one_accepted_update
-BEFORE UPDATE OF accepted ON turn_attempts
-WHEN NEW.accepted = 1 AND EXISTS (
-    SELECT 1
-    FROM turn_attempts existing
-    JOIN inference_calls old_call ON old_call.id = existing.model_call_id
-    JOIN inference_calls new_call ON new_call.id = NEW.model_call_id
-    WHERE old_call.turn_id = new_call.turn_id
-      AND existing.id != OLD.id
-      AND existing.accepted = 1
-)
-BEGIN
-    SELECT RAISE(ABORT, 'one emission may be accepted per turn');
-END;
-
--- {§provider-request-accounting}: one row is opened before one physical
--- provider request and settled exactly once with the evidence from that request.
--- Monetary values remain canonical decimal strings; SQLite REAL is never an
--- accounting representation.
-CREATE TABLE IF NOT EXISTS provider_requests (
-    id                       INTEGER NOT NULL PRIMARY KEY,
-    inference_call_id        INTEGER NOT NULL,
-    sequence                 INTEGER NOT NULL CHECK (sequence >= 1),
-    provider                 TEXT    NOT NULL CHECK (length(provider) > 0),
-    model                    TEXT    NOT NULL CHECK (length(model) > 0),
-    state                    TEXT    NOT NULL DEFAULT 'pending' CHECK (state IN ('pending', 'settled')),
-    outcome                  TEXT             CHECK (outcome IN ('response', 'error')),
-    status                   INTEGER          CHECK (status IS NULL OR status BETWEEN 100 AND 599),
-    usage_input              INTEGER          CHECK (usage_input IS NULL OR usage_input >= 0),
-    usage_output             INTEGER          CHECK (usage_output IS NULL OR usage_output >= 0),
-    usage_total              INTEGER          CHECK (usage_total IS NULL OR usage_total >= 0),
-    usage_input_no_cache     INTEGER          CHECK (usage_input_no_cache IS NULL OR usage_input_no_cache >= 0),
-    usage_input_cache_read   INTEGER          CHECK (usage_input_cache_read IS NULL OR usage_input_cache_read >= 0),
-    usage_input_cache_write  INTEGER          CHECK (usage_input_cache_write IS NULL OR usage_input_cache_write >= 0),
-    usage_output_text        INTEGER          CHECK (usage_output_text IS NULL OR usage_output_text >= 0),
-    usage_output_reasoning   INTEGER          CHECK (usage_output_reasoning IS NULL OR usage_output_reasoning >= 0),
-    cost_kind                TEXT             CHECK (cost_kind IN ('charged', 'estimated', 'unknown')),
-    cost_amount              TEXT,
-    cost_currency            TEXT,
-    cost_usd_equivalent      TEXT,
-    cost_source              TEXT,
-    cost_reason              TEXT,
-    started_at               TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    completed_at             TEXT,
-    CHECK (
-        (state = 'pending'
-            AND outcome IS NULL AND status IS NULL
-            AND usage_input IS NULL AND usage_output IS NULL AND usage_total IS NULL
-            AND usage_input_no_cache IS NULL AND usage_input_cache_read IS NULL
-            AND usage_input_cache_write IS NULL AND usage_output_text IS NULL
-            AND usage_output_reasoning IS NULL
-            AND cost_kind IS NULL AND cost_amount IS NULL AND cost_currency IS NULL
-            AND cost_usd_equivalent IS NULL AND cost_source IS NULL AND cost_reason IS NULL
-            AND completed_at IS NULL)
-        OR
-        (state = 'settled' AND outcome IS NOT NULL AND cost_kind IS NOT NULL AND completed_at IS NOT NULL)
-    ),
-    CHECK (
-        cost_amount IS NULL OR (
-            length(cost_amount) > 0
-            AND cost_amount NOT GLOB '*[^0-9.]*'
-            AND cost_amount NOT LIKE '.%'
-            AND cost_amount NOT LIKE '%.'
-            AND cost_amount NOT LIKE '%.%.%'
-            AND (cost_amount = '0' OR cost_amount NOT GLOB '0[0-9]*')
-        )
-    ),
-    CHECK (
-        cost_usd_equivalent IS NULL OR (
-            length(cost_usd_equivalent) > 0
-            AND cost_usd_equivalent NOT GLOB '*[^0-9.]*'
-            AND cost_usd_equivalent NOT LIKE '.%'
-            AND cost_usd_equivalent NOT LIKE '%.'
-            AND cost_usd_equivalent NOT LIKE '%.%.%'
-            AND (cost_usd_equivalent = '0' OR cost_usd_equivalent NOT GLOB '0[0-9]*')
-        )
-    ),
-    CHECK (
-        cost_currency IS NULL OR (
-            length(cost_currency) BETWEEN 3 AND 12
-            AND substr(cost_currency, 1, 1) GLOB '[A-Z]'
-            AND cost_currency NOT GLOB '*[^A-Z0-9]*'
-        )
-    ),
-    CHECK (
-        cost_kind IS NULL
-        OR (cost_kind = 'charged'
-            AND cost_amount IS NOT NULL AND cost_currency IS NOT NULL
-            AND cost_source IS NOT NULL AND length(cost_source) > 0
-            AND cost_reason IS NULL)
-        OR (cost_kind = 'estimated'
-            AND cost_amount IS NOT NULL AND cost_currency IS NOT NULL
-            AND cost_usd_equivalent IS NULL
-            AND cost_source IS NOT NULL AND length(cost_source) > 0
-            AND cost_reason IS NULL)
-        OR (cost_kind = 'unknown'
-            AND cost_amount IS NULL AND cost_currency IS NULL
-            AND cost_usd_equivalent IS NULL AND cost_source IS NULL
-            AND cost_reason IS NOT NULL AND length(cost_reason) > 0)
-    ),
-    UNIQUE (inference_call_id, sequence),
-    FOREIGN KEY (inference_call_id) REFERENCES inference_calls(id) ON DELETE CASCADE
-) STRICT;
-
-CREATE TRIGGER IF NOT EXISTS provider_requests_pending_inference_only
-BEFORE INSERT ON provider_requests
-WHEN COALESCE((SELECT state = 'pending' FROM inference_calls WHERE id = NEW.inference_call_id), 0) != 1
-  OR COALESCE((
-      SELECT kind NOT IN ('embedding_query', 'embedding_documents') OR ec.input_count IS NOT NULL
-      FROM inference_calls ic
-      LEFT JOIN embedding_calls ec ON ec.id = ic.id
-      WHERE ic.id = NEW.inference_call_id
-  ), 0) != 1
-BEGIN
-    SELECT RAISE(ABORT, 'provider request requires a prepared pending inference call');
-END;
-
-CREATE TRIGGER IF NOT EXISTS provider_requests_identity_immutable
-BEFORE UPDATE OF inference_call_id, sequence, provider, model, started_at
-ON provider_requests
-BEGIN
-    SELECT RAISE(ABORT, 'provider request identity is immutable');
-END;
-
-CREATE INDEX IF NOT EXISTS provider_requests_inference_call_id
-    ON provider_requests (inference_call_id, sequence);
-
-CREATE TRIGGER IF NOT EXISTS provider_requests_state_forward_only
-BEFORE UPDATE OF state ON provider_requests
-WHEN NOT (NEW.state = OLD.state OR (OLD.state = 'pending' AND NEW.state = 'settled'))
-BEGIN
-    SELECT RAISE(ABORT, 'provider request may only settle once');
-END;
-
-CREATE TRIGGER IF NOT EXISTS provider_requests_settlement_immutable
-BEFORE UPDATE OF outcome, status,
-                 usage_input, usage_output, usage_total,
-                 usage_input_no_cache, usage_input_cache_read, usage_input_cache_write,
-                 usage_output_text, usage_output_reasoning,
-                 cost_kind, cost_amount, cost_currency, cost_usd_equivalent,
-                 cost_source, cost_reason, completed_at
-ON provider_requests
-WHEN OLD.state != 'pending'
-BEGIN
-    SELECT RAISE(ABORT, 'provider request settlement is immutable');
-END;
-
--- derivations
--- Content-addressed deep projections. Entry channels and log projections point
--- at a COMPLETE artifact by deep_hash; graph, FTS, and vectors are stored once
--- regardless of how many addresses carry identical content under the same reader/config.
--- A building row is unattached and safely replaceable after interruption.
-CREATE TABLE IF NOT EXISTS derivations (
-    id          INTEGER NOT NULL PRIMARY KEY,
-    deep_hash   TEXT    NOT NULL UNIQUE CHECK (length(deep_hash) > 0),
-    state       TEXT    NOT NULL DEFAULT 'building' CHECK (state IN ('building', 'complete')),
-    disposition TEXT    CHECK (disposition IN ('vector', 'lexical', 'excluded', 'nonsemantic', 'failed')),
-    reason      TEXT,
-    parse_issues INTEGER CHECK (parse_issues IS NULL OR parse_issues > 0),
-    summary     TEXT    CHECK (
-        summary IS NULL OR (
-            length(summary) > 0
-            AND summary = trim(summary)
-            AND instr(summary, char(10)) = 0
-            AND instr(summary, char(13)) = 0
-        )
-    ),
-    CHECK ((state = 'building' AND disposition IS NULL) OR (state = 'complete' AND disposition IS NOT NULL))
-) STRICT;
-
--- entries
--- The canonical addressable store. (owner, scheme, authority, pathname) is the identity
--- tuple, and NO component may be NULL: NULLs are distinct under SQL UNIQUE, so a nullable
--- component voids the identity index. Bare/file paths persist under the reserved `file`
--- scheme; they still render as bare paths. {§entry-identity-no-null}
-CREATE TABLE IF NOT EXISTS entries (
-    id         INTEGER NOT NULL PRIMARY KEY,
-    version    INTEGER NOT NULL DEFAULT 0   CHECK (version >= 0),
-    scheme     TEXT    NOT NULL             CHECK (length(scheme) > 0),
-    -- Canonical RFC authority for resource-addressed schemes. Namespace schemes
-    -- fold authored authority into pathname; owner-addressed schemes consume it
-    -- into owner_id. Empty is therefore the canonical no-resource-authority value.
-    authority  TEXT    NOT NULL DEFAULT '',
-    pathname   TEXT    NOT NULL,
-    -- {§entry-owner} — every entry is owned by a worker: the spawning worker for capability
-    -- streams, the workspace's reserved 'commons' worker for shared content. A real row, never
-    -- NULL (NULLs are distinct under UNIQUE — a nullable owner would let the commons fragment).
-    -- The id never renders into a URI or packet; the model addresses owners by NAME (authority).
-    owner_id   INTEGER NOT NULL,
-    -- Entry-private metadata. Prompt frames use `openPaths` to carry selected
-    -- workspace paths into the exact turn that publishes the frame
-    -- ({§methods-loop-run-open-paths}).
-    attributes TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(attributes)),
-    -- SPEC {§membership} — how a file member entered the curated surface. 'git' rows are
-    -- reconciled against the repo's members each turn — tracked ls-files PLUS untracked-
-    -- but-not-ignored files ({§membership-auto-add}) — registered + un-registered so entries
-    -- == members; 'constraint' rows are reconciled from ordinary pick policy.
-    -- NULL = not a file member (other schemes don't carry origin).
-    membership_origin TEXT                   CHECK (membership_origin IS NULL OR membership_origin IN ('git', 'constraint')),
-    -- SPEC {§membership-change-gated-sync} — the per-member sync stat-detect:
-    -- "<mtimeMs>:<size>" of the disk file at its last materialization, or `absent`
-    -- after an observed deletion. The pre-turn
-    -- sync stat()s every member but re-reads/re-tokenizes/rewrites only one whose
-    -- signature changed; an unchanged member is a no-op. NULL = never synced.
-    synced_sig TEXT,
-    -- User Note 5 — manifest cache-friendliness. Last-modified stamp, bumped on every
-    -- addressable representation change; engine_list_workspace_entries orders the catalog
-    -- by it ASC so dormant entries hold the stable prompt-cache prefix. Private derivation
-    -- attachment does not make an entry recently touched.
-    updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    FOREIGN KEY (owner_id)     REFERENCES workers(id)    ON DELETE CASCADE
-) STRICT;
-
--- {§entry-owner} / {§stream-owner-scoped} — owner is the sole visibility and identity axis.
--- Concurrent workers' capability streams share the loop-relative coordinate (every worker's first
--- loop is seq 1), so identity keys on the owner and identical coordinates are distinct rows
--- ({§stream-owner-scoped}).
-CREATE UNIQUE INDEX IF NOT EXISTS entries_identity ON entries (owner_id, scheme, authority, pathname);
-CREATE UNIQUE INDEX IF NOT EXISTS entries_id_owner ON entries (id, owner_id);
-
--- The ONE engine-imposed constraint (SPEC {§stream-constraints}, {§stream-constraints-engine-one-cap}): 100 MiB char-length cap
--- per channel content body. All other limits are extrinsic.
-CREATE TABLE IF NOT EXISTS entry_channels (
-    entry_id INTEGER NOT NULL,
-    name     TEXT    NOT NULL             CHECK (length(name) > 0),
-    content  TEXT    NOT NULL             CHECK (length(content) <= 104857600),
-    mimetype TEXT    NOT NULL             CHECK (length(mimetype) > 0),
-    weight   INTEGER NOT NULL DEFAULT 0   CHECK (weight >= 0),
-    -- Content identity: sha256 of content, stamped at static writes; streamed
-    -- appends leave it NULL. Curation weight remains model-independent.
-    content_hash TEXT,
-    -- Search derivation for this exact addressable channel representation.
-    -- Content or mimetype changes invalidate it at the owning channel row.
-    deep_hash TEXT,
-    state    TEXT    NOT NULL DEFAULT 'static' CHECK (state IN ('static', 'active', 'closed', 'errored')),
-    -- Exact terminal producer evidence for this representation channel. NULL is
-    -- the ordinary implicit {status:200}; selection/projection metadata belongs
-    -- to core and is never stored here.
-    producer_result TEXT,
-    CONSTRAINT entry_channel_producer_result_contract CHECK (
-        CASE
-            WHEN producer_result IS NULL THEN 1
-            WHEN NOT json_valid(producer_result) THEN 0
-            ELSE
-                json_type(producer_result) IS 'object'
-                AND json_type(producer_result, '$.status') IS 'integer'
-                AND json_extract(producer_result, '$.status') BETWEEN 200 AND 599
-                AND json_extract(producer_result, '$.status') != 202
-                AND CASE
-                    WHEN json_extract(producer_result, '$.status') < 400 THEN
-                        json_type(producer_result, '$.problem') IS NULL
-                    ELSE
-                        json_type(producer_result, '$.problem') IS 'object'
-                        AND json_type(producer_result, '$.problem.status') IS 'integer'
-                        AND json_extract(producer_result, '$.problem.status')
-                            = json_extract(producer_result, '$.status')
-                        AND json_type(producer_result, '$.problem.type') IS 'text'
-                        AND length(json_extract(producer_result, '$.problem.type')) > 0
-                        AND json_type(producer_result, '$.problem.title') IS 'text'
-                        AND length(json_extract(producer_result, '$.problem.title')) > 0
-                        AND json_type(producer_result, '$.problem.detail') IS 'text'
-                        AND length(json_extract(producer_result, '$.problem.detail')) > 0
-                END
-        END
-    ),
-    PRIMARY KEY (entry_id, name),
-    FOREIGN KEY (entry_id) REFERENCES entries(id) ON DELETE CASCADE,
-    FOREIGN KEY (deep_hash) REFERENCES derivations(deep_hash)
-) STRICT, WITHOUT ROWID;
-
--- A changed channel representation cannot retain search evidence derived from
--- its predecessor. This trigger is the one invalidation owner for every write
--- path, including model EDIT, plugin channel capabilities, and streams.
-CREATE TRIGGER IF NOT EXISTS entry_channels_invalidate_derivation
-AFTER UPDATE OF content, mimetype ON entry_channels
-WHEN OLD.content IS NOT NEW.content OR OLD.mimetype IS NOT NEW.mimetype
-BEGIN
-    UPDATE entry_channels
-    SET deep_hash = NULL
-    WHERE entry_id = NEW.entry_id AND name = NEW.name AND deep_hash IS NOT NULL;
-END;
-
--- User Note 5 — bump the entry's updated_at on addressable representation or
--- lifecycle writes so the catalog (ordered by updated_at ASC) keeps recently-
--- touched entries at the tail and holds the prompt-cache prefix stable across
--- turns. Content hashes and search attachments are private metadata, not touches.
-CREATE TRIGGER IF NOT EXISTS entries_touch_on_channel_write
-AFTER INSERT ON entry_channels
-BEGIN
-    UPDATE entries SET updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = NEW.entry_id;
-END;
-
-CREATE TRIGGER IF NOT EXISTS entries_touch_on_channel_update
-AFTER UPDATE OF content, mimetype, weight, state, producer_result ON entry_channels
-BEGIN
-    UPDATE entries SET updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = NEW.entry_id;
-END;
-
--- symbol_defs
--- &graph NODES ({§relation-indexed-dialects}). Code symbol definitions, populated
--- once per content-addressed derivation from mimetypes'
--- `symbols` channel. Qualified path = container ? container || '.' || name : name.
-CREATE TABLE IF NOT EXISTS symbol_defs (
-    id         INTEGER NOT NULL PRIMARY KEY,
-    derivation_id INTEGER NOT NULL,
-    name       TEXT    NOT NULL CHECK (length(name) > 0),
-    kind       TEXT    NOT NULL,
-    container  TEXT,
-    line       INTEGER NOT NULL,
-    end_line   INTEGER,
-    FOREIGN KEY (derivation_id) REFERENCES derivations(id) ON DELETE CASCADE
-) STRICT;
-
-CREATE INDEX IF NOT EXISTS symbol_defs_name ON symbol_defs (name);
-
--- symbol_refs
--- &graph EDGES ({§relation-indexed-dialects}), from mimetypes' `references` channel.
--- name = edge TARGET; container = the SOURCE def's full qualified path (the
--- &> join key; module-level → NULL); kind ∈ import|call|instantiate|inherit|
--- type|use (frozen, edge metadata only — traversal is kind-agnostic).
-CREATE TABLE IF NOT EXISTS symbol_refs (
-    id         INTEGER NOT NULL PRIMARY KEY,
-    derivation_id INTEGER NOT NULL,
-    name       TEXT    NOT NULL CHECK (length(name) > 0),
-    kind       TEXT    NOT NULL,
-    container  TEXT,
-    line       INTEGER NOT NULL,
-    col        INTEGER,
-    FOREIGN KEY (derivation_id) REFERENCES derivations(id) ON DELETE CASCADE
-) STRICT;
-
-CREATE INDEX IF NOT EXISTS symbol_refs_name   ON symbol_refs (name);
-CREATE INDEX IF NOT EXISTS symbol_refs_source ON symbol_refs (derivation_id, container);
-
--- derivation_fts (~semantic keyword fallback; {§relation-indexed-dialects})
--- Keyword/content index over a derivation's readable content; rowid IS derivations.id.
--- Explicit keyword fallback when no embedder is installed. Vector search never
--- consults this table: semantic recall is exhaustive over complete vectors.
-CREATE VIRTUAL TABLE IF NOT EXISTS derivation_fts USING fts5(content);
-
--- derivation_embeddings (~semantic vectors; {§relation-indexed-dialects}).
--- One canonical wire vector ({§mimetype-embedding-wire}) per CHUNK: a derivation tiles into N chunks,
--- each addressed by its <L> line range (line_start..line_end) and embedded
--- separately, so a large body is fully searchable instead of truncated at the
--- embedder's window. line_start/line_end are stored for Project Findings to expose;
--- the rank currently max-pools a derivation's chunks, then projects every attached
--- pathname. semantic_rank exhaustively cosine-ranks these.
--- CASCADE-deleted with the derivation artifact.
-CREATE TABLE IF NOT EXISTS derivation_embeddings (
-    derivation_id   INTEGER NOT NULL,
-    chunk_seq       INTEGER NOT NULL,
-    line_start      INTEGER NOT NULL,
-    line_end        INTEGER NOT NULL,
-    vector          BLOB    NOT NULL,
-    -- The model id that produced this vector (mimetypes' `embeddingModel`). Stored
-    -- per row as the dimension/staleness guard: rank filters by the current model so
-    -- a swap never cosine-compares mismatched dimensions.
-    embedding_model TEXT    NOT NULL,
-    PRIMARY KEY (derivation_id, chunk_seq),
-    FOREIGN KEY (derivation_id) REFERENCES derivations(id) ON DELETE CASCADE
-) STRICT;
-
--- log_entries
--- Chronological event store. sequence is 1-based, scoped to the turn —
--- resets at each new turn. URI-bit columns are unprefixed (scheme,
--- pathname, …). state/outcome/attrs carry the proposal lifecycle —
--- status⊥state: status is the HTTP outcome, state is where in the
--- lifecycle the entry sits. Most rows write 'resolved' directly;
--- proposing schemes transition 'proposed' → resolved/failed/cancelled.
--- initial_folded is the immutable visibility with which the event entered the
--- log. Current model-facing membership and folded intervals belong to
--- log_entry_projections below; curation never rewrites or removes this event.
-CREATE TABLE IF NOT EXISTS log_entries (
-    id              INTEGER NOT NULL PRIMARY KEY,
-    version         INTEGER NOT NULL DEFAULT 0 CHECK (version >= 0),
-
-    worker_id          INTEGER NOT NULL,
-    loop_id         INTEGER NOT NULL,
-    turn_id         INTEGER NOT NULL,
-    sequence        INTEGER NOT NULL           CHECK (sequence >= 1),
-    at              TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    origin          TEXT    NOT NULL           CHECK (origin IN ('model', 'client', '_plurnk', 'plugin')),
-    -- {§env-delta-attribution}: a causal worker:// identity, log:/// operation
-    -- address, or stable subsystem token ('file'); NULL = the owning worker
-    -- itself, rendered without causal attribution.
-    source          TEXT,
-    -- Engine-owned occurrence identity. Source rows are stamped NULL→id by the
-    -- journal trigger; observer and fork copies carry it at insertion.
-    ambient_event_id INTEGER                  REFERENCES ambient_events(id),
-    -- Fork history is copied evidence, never new activity. Rows with no source
-    -- occurrence still need this structural guard against republication.
-    inherited_history INTEGER NOT NULL DEFAULT 0 CHECK (inherited_history IN (0, 1)),
-    -- Search derivation attached to this durable log result, when available.
-    deep_hash       TEXT                       REFERENCES derivations(deep_hash),
-    -- Exact logical provider call represented by a BARE result, admitted
-    -- model turnOps, or rejected emissionAttempt. Other operation and ambient
-    -- rows carry no model-call identity.
-    model_call_id   INTEGER                    REFERENCES model_calls(id),
-    -- Engine-owned stream publication that produced this observation. The
-    -- publication cursor survives log curation; this relation is evidence,
-    -- never the acknowledgement itself. {§exec-stream}
-    subscription_publication_id INTEGER        REFERENCES subscription_publications(id) ON DELETE SET NULL,
-
-    -- 'error' is an ACTIONLESS row ({§operation-results} — errors are log items): a parse failure that
-    -- produced no op still records a log entry (op='error', status_rx≥400, no target) so the model
-    -- can fold/kill/recall its own mistakes like any other log row — one budget surface, the log.
-    -- Exact producer source and rejected-attempt artifacts carry NULL here
-    -- ({§turn-ops-entry}, {§rejected-emission-entry}).
-    -- No op enum here: the grammar op set is grammar's contract (PlurnkOp), and this column is written
-    -- only by the PlurnkOp-typed engine (grammar ops), service row selectors, or NULL for no op.
-    -- A SQL enum would be a hand-copy of grammar's op list that silently goes stale on every new verb
-    -- (it did — FORK/WORK). Validity lives at the parse + type layer, not duplicated in DDL.
-    op              TEXT,
-    delimiter          TEXT    NOT NULL DEFAULT '',
-    signal          TEXT                       CHECK (signal IS NULL OR json_valid(signal)),
-
-    scheme          TEXT                       CHECK (scheme IS NULL OR length(scheme) > 0),
-    username        TEXT,
-    password        TEXT,
-    hostname        TEXT,
-    port            INTEGER                    CHECK (port IS NULL OR (port BETWEEN 0 AND 65535)),
-    pathname        TEXT,
-    -- Serialized query without '?'; NULL = absent, '' = explicit empty. {§path-query}
-    query           TEXT,
-    fragment        TEXT,
-
-    lineMarker      TEXT                       CHECK (lineMarker IS NULL OR json_valid(lineMarker)),
-
-    tx              TEXT    NOT NULL,
-    mimetype_tx     TEXT    NOT NULL           CHECK (length(mimetype_tx) > 0),
-
-    rx              TEXT    NOT NULL,
-    mimetype_rx     TEXT    NOT NULL           CHECK (length(mimetype_rx) > 0),
-    status_rx       INTEGER NOT NULL           CHECK (status_rx BETWEEN 100 AND 599),
-
-    -- Complete canonical LogBody content before coordinate/presentation
-    -- projection; persistence envelopes do not contribute. {§tokenomics-weight-stored-at-write}
-    weight          INTEGER NOT NULL DEFAULT 0 CHECK (weight >= 0),
-
-    state           TEXT    NOT NULL DEFAULT 'resolved'
-                    CHECK (state IN ('proposed', 'resolved', 'failed', 'cancelled')),
-    outcome         TEXT,
-    attrs           TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(attrs)),
-
-    initial_folded   TEXT    NOT NULL DEFAULT '[]'
-                    CHECK (json_valid(initial_folded) AND json_type(initial_folded) = 'array'),
-
-    CHECK (
-        (op IS NULL) = COALESCE(
-            json_extract(attrs, '$.kind') IN ('turnOps', 'emissionAttempt'),
-            0
-        )
-    ),
-    CHECK (json_extract(attrs, '$.kind') != 'emissionAttempt' OR origin = 'model'),
-
-    FOREIGN KEY (worker_id)  REFERENCES workers(id)  ON DELETE CASCADE,
-    FOREIGN KEY (loop_id) REFERENCES loops(id) ON DELETE CASCADE,
-    FOREIGN KEY (turn_id) REFERENCES turns(id) ON DELETE CASCADE
-) STRICT;
-
-CREATE UNIQUE INDEX IF NOT EXISTS log_entries_turn_id_sequence ON log_entries (turn_id, sequence);
-CREATE        INDEX IF NOT EXISTS log_entries_worker_id           ON log_entries (worker_id);
-CREATE        INDEX IF NOT EXISTS log_entries_loop_id          ON log_entries (loop_id);
-CREATE        INDEX IF NOT EXISTS log_entries_at               ON log_entries (at);
-CREATE UNIQUE INDEX IF NOT EXISTS log_entries_model_call_id
-    ON log_entries (model_call_id)
-    WHERE model_call_id IS NOT NULL;
-CREATE INDEX IF NOT EXISTS log_entries_subscription_publication_id
-    ON log_entries (subscription_publication_id)
-    WHERE subscription_publication_id IS NOT NULL;
-CREATE UNIQUE INDEX IF NOT EXISTS log_entries_worker_ambient_event
-    ON log_entries (worker_id, ambient_event_id)
-    WHERE ambient_event_id IS NOT NULL;
-
--- {§log-history-projection} — log_entries is append-only execution evidence;
--- this one-to-one row is the current model-facing projection of that evidence.
--- KILL is a terminal active→inactive transition. Scoped KILL mutates only folded
--- intervals while active. The initial state is created in the same statement as
--- its event so no durable row can exist without one projection state.
-CREATE TABLE IF NOT EXISTS log_entry_projections (
-    log_entry_id INTEGER NOT NULL PRIMARY KEY,
-    active       INTEGER NOT NULL DEFAULT 1 CHECK (active IN (0, 1)),
-    folded       TEXT    NOT NULL DEFAULT '[]'
-                         CHECK (json_valid(folded) AND json_type(folded) = 'array'),
-    FOREIGN KEY (log_entry_id) REFERENCES log_entries(id) ON DELETE CASCADE
-) STRICT, WITHOUT ROWID;
-
--- The ordinary operation surface reads this view. Forensic and lifecycle
--- machinery names log_entries directly and therefore retains complete history.
-CREATE VIEW IF NOT EXISTS active_log_entries AS
-SELECT le.*, projection.folded
-FROM log_entries le
-JOIN log_entry_projections projection ON projection.log_entry_id = le.id
-WHERE projection.active = 1;
-
--- {§packet-attachment-parts} — absence means an attachable READ may still
--- contribute native content. Presence is the append-only fact that a completed
--- model response crossed that one-shot delivery boundary. This lifecycle is not
--- part of the log-curation projection.
-CREATE TABLE IF NOT EXISTS native_content_deliveries (
-    log_entry_id INTEGER NOT NULL PRIMARY KEY,
-    delivered_at TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    FOREIGN KEY (log_entry_id) REFERENCES log_entries(id) ON DELETE CASCADE
-) STRICT, WITHOUT ROWID;
-
-CREATE TRIGGER IF NOT EXISTS model_calls_native_inputs_valid
-BEFORE UPDATE OF native_inputs ON model_calls
-WHEN (
-    SELECT COUNT(*) != COUNT(DISTINCT value)
-        OR SUM(CASE WHEN type != 'text' OR length(value) = 0 THEN 1 ELSE 0 END) > 0
-    FROM json_each(NEW.native_inputs)
-)
-OR EXISTS (
-    SELECT 1
-    FROM json_each(NEW.native_inputs) native
-    WHERE NOT EXISTS (
-        SELECT 1
-        FROM inference_calls call
-        JOIN turns request_turn ON request_turn.id = call.turn_id
-        JOIN loops request_loop ON request_loop.id = request_turn.loop_id
-        JOIN log_entries entry ON entry.worker_id = request_loop.worker_id
-        JOIN turns entry_turn ON entry_turn.id = entry.turn_id
-        JOIN loops entry_loop ON entry_loop.id = entry_turn.loop_id
-        WHERE call.id = NEW.id
-          AND entry.op = 'READ'
-          AND entry.status_rx < 400
-          AND (entry_loop.sequence || '/' || entry_turn.sequence || '/' || entry.sequence) = native.value
-    )
-)
-BEGIN
-    SELECT RAISE(ABORT, 'model call native inputs must be unique successful READ coordinates owned by its worker');
-END;
-
--- Closing a model call with response evidence is the native-content delivery
--- boundary. Both facts commit in the same SQLite statement; a call that ends
--- without a response cannot consume native content.
-CREATE TRIGGER IF NOT EXISTS native_content_deliveries_from_model_response
-AFTER UPDATE OF response, native_inputs ON model_calls
-WHEN NEW.response IS NOT NULL
-BEGIN
-    INSERT INTO native_content_deliveries (log_entry_id)
-    SELECT entry.id
-    FROM json_each(NEW.native_inputs) native
-    JOIN inference_calls call ON call.id = NEW.id
-    JOIN turns request_turn ON request_turn.id = call.turn_id
-    JOIN loops request_loop ON request_loop.id = request_turn.loop_id
-    JOIN log_entries entry ON entry.worker_id = request_loop.worker_id
-    JOIN turns entry_turn ON entry_turn.id = entry.turn_id
-    JOIN loops entry_loop ON entry_loop.id = entry_turn.loop_id
-    WHERE (entry_loop.sequence || '/' || entry_turn.sequence || '/' || entry.sequence) = native.value
-    ON CONFLICT (log_entry_id) DO NOTHING;
-END;
-
-CREATE TRIGGER IF NOT EXISTS native_content_deliveries_immutable
-BEFORE UPDATE ON native_content_deliveries
-BEGIN
-    SELECT RAISE(ABORT, 'native-content delivery evidence is immutable');
-END;
-
-CREATE TRIGGER IF NOT EXISTS log_entries_initialize_projection
-AFTER INSERT ON log_entries
-BEGIN
-    INSERT INTO log_entry_projections (log_entry_id, active, folded)
-    VALUES (NEW.id, 1, NEW.initial_folded);
-END;
-
--- Individual execution events are append-only. Containing-history teardown is
--- the one removal owner: a cascading delete has already removed at least one
--- ancestor in the workspace→worker→loop→turn chain. A direct row delete while
--- that complete owner chain remains would fabricate chronology and is rejected.
-CREATE TRIGGER IF NOT EXISTS log_entries_delete_with_owner_only
-BEFORE DELETE ON log_entries
-WHEN EXISTS (
-    SELECT 1
-    FROM turns
-    JOIN loops ON loops.id = turns.loop_id
-    JOIN workers ON workers.id = loops.worker_id
-    JOIN workspaces ON workspaces.id = workers.workspace_id
-    WHERE turns.id = OLD.turn_id
-)
-BEGIN
-    SELECT RAISE(ABORT, 'log entries can only be removed with their containing history');
-END;
-
--- A log row belongs to one exact worker/loop/turn chain. Its writer is either
--- that turn's producer or `_plurnk` observing the turn. Primitive absence,
--- enum, and foreign-key failures remain owned by their column constraints.
-CREATE TRIGGER IF NOT EXISTS log_entries_turn_ownership
-BEFORE INSERT ON log_entries
-WHEN NEW.worker_id IS NOT NULL
- AND NEW.loop_id IS NOT NULL
- AND NEW.turn_id IS NOT NULL
- AND NEW.origin IN ('model', 'client', '_plurnk', 'plugin')
- AND EXISTS (SELECT 1 FROM workers WHERE id = NEW.worker_id)
- AND EXISTS (SELECT 1 FROM loops WHERE id = NEW.loop_id)
- AND EXISTS (SELECT 1 FROM turns WHERE id = NEW.turn_id)
- AND NOT EXISTS (
-    SELECT 1
-    FROM turns
-    JOIN loops ON loops.id = turns.loop_id
-    WHERE turns.id = NEW.turn_id
-      AND loops.id = NEW.loop_id
-      AND loops.worker_id = NEW.worker_id
-      AND (NEW.origin = turns.producer OR NEW.origin = '_plurnk')
-)
-BEGIN
-    SELECT RAISE(ABORT, 'log entry must match its turn ownership and producer');
-END;
-
--- {§turn-ops-entry} — exact admitted source is authored by the turn producer.
--- `_plurnk` may observe another producer's turn through ordinary operation
--- rows, but it cannot impersonate that producer's source program.
-CREATE TRIGGER IF NOT EXISTS log_entries_turn_ops_producer
-BEFORE INSERT ON log_entries
-WHEN NEW.op IS NULL
- AND json_extract(NEW.attrs, '$.kind') = 'turnOps'
- AND EXISTS (SELECT 1 FROM turns WHERE id = NEW.turn_id)
- AND NOT EXISTS (
-    SELECT 1
-    FROM turns
-    WHERE turns.id = NEW.turn_id
-      AND turns.producer = NEW.origin
- )
-BEGIN
-    SELECT RAISE(ABORT, 'actionless log entry does not match its turn producer');
-END;
-
--- A folded interval is an inclusive [start,end] pair. Ranges are positive,
--- sorted, disjoint, and non-adjacent; -1 is the final open-ended endpoint.
--- Canonical intervals make visibility equality and curation effects exact.
-CREATE TRIGGER IF NOT EXISTS log_entry_projections_folded_valid_insert
-BEFORE INSERT ON log_entry_projections
-WHEN EXISTS (
-    SELECT 1
-    FROM json_each(NEW.folded) range
-    WHERE range.type != 'array'
-       OR json_array_length(range.value) != 2
-       OR COALESCE(json_type(range.value, '$[0]'), '') != 'integer'
-       OR COALESCE(json_type(range.value, '$[1]'), '') != 'integer'
-       OR json_extract(range.value, '$[0]') < 1
-       OR (
-           json_extract(range.value, '$[1]') != -1
-           AND json_extract(range.value, '$[1]') < json_extract(range.value, '$[0]')
-       )
-       OR EXISTS (
-           SELECT 1
-           FROM json_each(NEW.folded) previous
-           WHERE previous.key = range.key - 1
-             AND (
-                 json_extract(previous.value, '$[1]') = -1
-                 OR json_extract(range.value, '$[0]') <= json_extract(previous.value, '$[1]') + 1
-             )
-       )
-)
-BEGIN
-    SELECT RAISE(ABORT, 'log entry projection folded ranges are invalid');
-END;
-
-CREATE TRIGGER IF NOT EXISTS log_entry_projections_folded_valid_update
-BEFORE UPDATE OF folded ON log_entry_projections
-WHEN EXISTS (
-    SELECT 1
-    FROM json_each(NEW.folded) range
-    WHERE range.type != 'array'
-       OR json_array_length(range.value) != 2
-       OR COALESCE(json_type(range.value, '$[0]'), '') != 'integer'
-       OR COALESCE(json_type(range.value, '$[1]'), '') != 'integer'
-       OR json_extract(range.value, '$[0]') < 1
-       OR (
-           json_extract(range.value, '$[1]') != -1
-           AND json_extract(range.value, '$[1]') < json_extract(range.value, '$[0]')
-       )
-       OR EXISTS (
-           SELECT 1
-           FROM json_each(NEW.folded) previous
-           WHERE previous.key = range.key - 1
-             AND (
-                 json_extract(previous.value, '$[1]') = -1
-                 OR json_extract(range.value, '$[0]') <= json_extract(previous.value, '$[1]') + 1
-             )
-       )
-)
-BEGIN
-    SELECT RAISE(ABORT, 'log entry projection folded ranges are invalid');
-END;
-
-CREATE TRIGGER IF NOT EXISTS log_entry_projections_kill_terminal
-BEFORE UPDATE OF active ON log_entry_projections
-WHEN OLD.active = 0 AND NEW.active != 0
-BEGIN
-    SELECT RAISE(ABORT, 'a killed log entry cannot re-enter the active projection');
-END;
-
-CREATE TRIGGER IF NOT EXISTS log_entry_projections_delete_with_event_only
-BEFORE DELETE ON log_entry_projections
-WHEN EXISTS (SELECT 1 FROM log_entries WHERE id = OLD.log_entry_id)
-BEGIN
-    SELECT RAISE(ABORT, 'a durable log event must retain its projection');
-END;
-
-CREATE TRIGGER IF NOT EXISTS log_entries_model_call_valid
-BEFORE INSERT ON log_entries
-WHEN NEW.model_call_id IS NOT NULL
- AND NOT EXISTS (
-    SELECT 1
-    FROM model_calls call
-    JOIN inference_calls inference ON inference.id = call.id
-    WHERE call.id = NEW.model_call_id
-      AND inference.turn_id = NEW.turn_id
-      AND inference.state != 'pending'
-      AND (
-          (inference.kind = 'bare' AND NEW.op = 'BARE')
-          OR (
-              inference.kind = 'emission'
-              AND NEW.op IS NULL
-              AND json_extract(NEW.attrs, '$.kind') IN ('turnOps', 'emissionAttempt')
-          )
-      )
- )
-BEGIN
-    SELECT RAISE(ABORT, 'log entry model call does not match its represented result');
-END;
-
-
-
--- Successful log-KILL rows are durable curation events even though
--- their ordinary packet projection is suppressed. Preserve the exact selected
--- set and each target's before/after projection so a broad selector never
--- collapses into the lossy fact `matched: N`.
-CREATE TABLE IF NOT EXISTS log_curation_effects (
-    operation_log_entry_id INTEGER NOT NULL,
-    target_log_entry_id    INTEGER NOT NULL,
-    active_before          INTEGER NOT NULL CHECK (active_before IN (0, 1)),
-    active_after           INTEGER NOT NULL CHECK (active_after IN (0, 1)),
-    folded_before          TEXT    NOT NULL
-                                  CHECK (json_valid(folded_before) AND json_type(folded_before) = 'array'),
-    folded_after           TEXT    NOT NULL
-                                  CHECK (json_valid(folded_after) AND json_type(folded_after) = 'array'),
-    PRIMARY KEY (operation_log_entry_id, target_log_entry_id),
-    CHECK (operation_log_entry_id != target_log_entry_id),
-    FOREIGN KEY (operation_log_entry_id) REFERENCES log_entries(id) ON DELETE CASCADE,
-    FOREIGN KEY (target_log_entry_id)    REFERENCES log_entries(id) ON DELETE CASCADE
-) STRICT, WITHOUT ROWID;
-
-CREATE INDEX IF NOT EXISTS log_curation_effects_target
-    ON log_curation_effects (target_log_entry_id);
-
--- Curation effects are append-only execution evidence. They may disappear
--- only when either referenced event is already being removed with its
--- containing history; direct mutation while both events survive is forbidden.
-CREATE TRIGGER IF NOT EXISTS log_curation_effects_immutable
-BEFORE UPDATE ON log_curation_effects
-BEGIN
-    SELECT RAISE(ABORT, 'log curation effects are immutable execution evidence');
-END;
-
-CREATE TRIGGER IF NOT EXISTS log_curation_effects_delete_with_history_only
-BEFORE DELETE ON log_curation_effects
-WHEN EXISTS (
-    SELECT 1 FROM log_entries WHERE id = OLD.operation_log_entry_id
-)
-AND EXISTS (
-    SELECT 1 FROM log_entries WHERE id = OLD.target_log_entry_id
-)
-BEGIN
-    SELECT RAISE(ABORT, 'log curation effects can only be removed with their containing history');
-END;
-
--- Make an invalid curation record structurally unavailable: the event must be
--- one successful log-KILL row, both rows must belong to the same
--- worker, and its state transition must match that op.
-CREATE TRIGGER IF NOT EXISTS log_curation_effects_valid
-BEFORE INSERT ON log_curation_effects
-BEGIN
-    SELECT CASE WHEN
-        NOT EXISTS (
-            SELECT 1
-            FROM log_entries operation
-            JOIN log_entries target ON target.id = NEW.target_log_entry_id
-            WHERE operation.id = NEW.operation_log_entry_id
-              AND operation.op = 'KILL'
-              AND operation.status_rx < 400
-              AND operation.worker_id = target.worker_id
-        )
-        OR NOT EXISTS (
-            -- {§log-kill-scope} — a scoped KILL keeps the row active and changes its visibility;
-            -- a whole KILL retires it with its visibility untouched.
-            SELECT 1
-            FROM log_entries operation
-            WHERE operation.id = NEW.operation_log_entry_id
-              AND operation.op = 'KILL'
-              AND operation.scheme = 'log'
-              AND NEW.active_before = 1
-              AND (
-                  NEW.active_after = 1
-                  OR (
-                      NEW.active_after = 0
-                      AND json(NEW.folded_before) = json(NEW.folded_after)
-                  )
-              )
-        )
-        OR EXISTS (
-            SELECT 1
-            FROM (
-                SELECT 'before' AS side, key, value, type FROM json_each(NEW.folded_before)
-                UNION ALL
-                SELECT 'after' AS side, key, value, type FROM json_each(NEW.folded_after)
-            ) range
-            WHERE range.type != 'array'
-               OR json_array_length(range.value) != 2
-               OR COALESCE(json_type(range.value, '$[0]'), '') != 'integer'
-               OR COALESCE(json_type(range.value, '$[1]'), '') != 'integer'
-               OR json_extract(range.value, '$[0]') < 1
-               OR (
-                   json_extract(range.value, '$[1]') != -1
-                   AND json_extract(range.value, '$[1]') < json_extract(range.value, '$[0]')
-               )
-               OR EXISTS (
-                   SELECT 1
-                   FROM (
-                       SELECT key, value FROM json_each(
-                           CASE range.side
-                               WHEN 'before' THEN NEW.folded_before
-                               ELSE NEW.folded_after
-                           END
-                       )
-                   ) previous
-                   WHERE previous.key = range.key - 1
-                     AND (
-                         json_extract(previous.value, '$[1]') = -1
-                         OR json_extract(range.value, '$[0]') <= json_extract(previous.value, '$[1]') + 1
-                     )
-               )
-        )
-    THEN RAISE(ABORT, 'invalid log curation effect') END;
-END;
-
--- The dispatcher binds an exact, transient curation plan into attrs on the
--- successful log-KILL row. No other row may carry that payload.
-CREATE TRIGGER IF NOT EXISTS log_entries_curation_payload_valid
-BEFORE INSERT ON log_entries
-WHEN json_type(NEW.attrs, '$.__plurnk_curation') IS NOT NULL
- AND NOT (
-    NEW.op = 'KILL'
-    AND NEW.status_rx < 400
-    AND NEW.scheme = 'log'
-    AND json_type(NEW.attrs, '$.__plurnk_curation') = 'object'
- )
-BEGIN
-    SELECT RAISE(ABORT, 'private log curation payload requires a successful log curation row');
-END;
-
--- One outer INSERT owns the whole landed curation event: exact selected rows,
--- their before/after projection, and the resulting current
--- state. Trigger failure rolls the operation row and all effects back together.
--- The private plan is erased before INSERT returns.
--- {§log-kill-scope} — a log KILL either retires a row whole (active 1→0, visibility untouched)
--- or folds a span of its body (active stays 1, visibility changes).
-CREATE TRIGGER IF NOT EXISTS log_entries_apply_curation
-AFTER INSERT ON log_entries
-WHEN NEW.op = 'KILL'
- AND NEW.status_rx < 400
- AND NEW.scheme = 'log'
- AND json_type(NEW.attrs, '$.__plurnk_curation') = 'object'
-BEGIN
-    SELECT CASE WHEN
-        COALESCE(json_type(NEW.attrs, '$.__plurnk_curation.targets'), '') != 'array'
-        OR json_array_length(NEW.attrs, '$.__plurnk_curation.targets') = 0
-        OR EXISTS (
-            SELECT 1
-            FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
-            WHERE selected.type != 'object'
-               OR COALESCE(json_type(selected.value, '$.id'), '') != 'integer'
-               OR json_extract(selected.value, '$.id') <= 0
-               OR COALESCE(json_type(selected.value, '$.activeBefore'), '') != 'integer'
-               OR json_extract(selected.value, '$.activeBefore') NOT IN (0, 1)
-               OR COALESCE(json_type(selected.value, '$.activeAfter'), '') != 'integer'
-               OR json_extract(selected.value, '$.activeAfter') NOT IN (0, 1)
-               OR COALESCE(json_type(selected.value, '$.foldedBefore'), '') != 'array'
-               OR COALESCE(json_type(selected.value, '$.foldedAfter'), '') != 'array'
-               OR EXISTS (
-                   SELECT 1 FROM json_each(selected.value) field
-                   WHERE field.key NOT IN ('id', 'activeBefore', 'activeAfter', 'foldedBefore', 'foldedAfter')
-               )
-               OR EXISTS (
-                   SELECT 1
-                   FROM (
-                       SELECT 'before' AS side, range.key, range.value, range.type
-                       FROM json_each(json_extract(selected.value, '$.foldedBefore')) range
-                       UNION ALL
-                       SELECT 'after' AS side, range.key, range.value, range.type
-                       FROM json_each(json_extract(selected.value, '$.foldedAfter')) range
-                   ) range
-                   WHERE range.type != 'array'
-                      OR json_array_length(range.value) != 2
-                      OR COALESCE(json_type(range.value, '$[0]'), '') != 'integer'
-                      OR COALESCE(json_type(range.value, '$[1]'), '') != 'integer'
-                      OR json_extract(range.value, '$[0]') < 1
-                      OR (
-                          json_extract(range.value, '$[1]') != -1
-                          AND json_extract(range.value, '$[1]') < json_extract(range.value, '$[0]')
-                      )
-                      OR EXISTS (
-                          SELECT 1
-                          FROM json_each(
-                              CASE range.side
-                                  WHEN 'before' THEN json_extract(selected.value, '$.foldedBefore')
-                                  ELSE json_extract(selected.value, '$.foldedAfter')
-                              END
-                          ) previous
-                          WHERE previous.key = range.key - 1
-                            AND (
-                                json_extract(previous.value, '$[1]') = -1
-                                OR json_extract(range.value, '$[0]') <= json_extract(previous.value, '$[1]') + 1
-                            )
-                      )
-               )
-        )
-        OR (
-            SELECT COUNT(*) FROM json_each(NEW.attrs, '$.__plurnk_curation.targets')
-        ) != (
-            SELECT COUNT(DISTINCT json_extract(value, '$.id'))
-            FROM json_each(NEW.attrs, '$.__plurnk_curation.targets')
-        )
-        OR EXISTS (
-            SELECT 1
-            FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
-            LEFT JOIN log_entries target ON target.id = json_extract(selected.value, '$.id')
-            LEFT JOIN log_entry_projections projection ON projection.log_entry_id = target.id
-            WHERE target.id IS NULL
-               OR projection.log_entry_id IS NULL
-               OR target.worker_id != NEW.worker_id
-               OR target.id = NEW.id
-               OR projection.active != json_extract(selected.value, '$.activeBefore')
-               OR json(projection.folded) != json(json_extract(selected.value, '$.foldedBefore'))
-               OR NOT (
-                   json_extract(selected.value, '$.activeBefore') = 1
-                   AND (
-                       json_extract(selected.value, '$.activeAfter') = 1
-                       OR json(json_extract(selected.value, '$.foldedBefore')) = json(json_extract(selected.value, '$.foldedAfter'))
-                   )
-               )
-        )
-    THEN RAISE(ABORT, 'invalid private log curation payload') END;
-
-    INSERT INTO log_curation_effects (
-        operation_log_entry_id,
-        target_log_entry_id,
-        active_before,
-        active_after,
-        folded_before,
-        folded_after
-    )
-    SELECT
-        NEW.id,
-        target.id,
-        json_extract(selected.value, '$.activeBefore'),
-        json_extract(selected.value, '$.activeAfter'),
-        json_extract(selected.value, '$.foldedBefore'),
-        json_extract(selected.value, '$.foldedAfter')
-    FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
-    JOIN log_entries target ON target.id = json_extract(selected.value, '$.id');
-
-    UPDATE log_entry_projections
-    SET active = (
-        SELECT json_extract(selected.value, '$.activeAfter')
-        FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
-        WHERE json_extract(selected.value, '$.id') = log_entry_projections.log_entry_id
-    ),
-        folded = (
-        SELECT json_extract(selected.value, '$.foldedAfter')
-        FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
-        WHERE json_extract(selected.value, '$.id') = log_entry_projections.log_entry_id
-    )
-    WHERE log_entry_id IN (
-        SELECT json_extract(value, '$.id')
-        FROM json_each(NEW.attrs, '$.__plurnk_curation.targets')
-    );
-
-    UPDATE log_entries
-    SET attrs = json_remove(attrs, '$.__plurnk_curation')
-    WHERE id = NEW.id;
-END;
-
--- Column-scoped immutability: the original action's identity, target, and
--- initial projection never change. Proposal lifecycle may mutate its outcome;
--- curation state lives outside the event row. Keep attrs separate so the
--- curation trigger's private-payload removal cannot exempt other columns.
-CREATE TRIGGER IF NOT EXISTS log_entries_immutable_core
-BEFORE UPDATE OF
-    worker_id, loop_id, turn_id, sequence, at, origin, source, inherited_history, model_call_id,
-    op, delimiter, signal,
-    scheme, username, password, hostname,
-    port, pathname, query, fragment,
-    lineMarker, tx, mimetype_tx, mimetype_rx, initial_folded
-ON log_entries
-BEGIN
-    SELECT RAISE(ABORT, 'log_entries core fields are immutable; only lifecycle outcome and derived attachments may change');
-END;
-
-CREATE TRIGGER IF NOT EXISTS log_entries_immutable_attrs
-BEFORE UPDATE OF attrs ON log_entries
-WHEN COALESCE((
-    json_type(OLD.attrs, '$.__plurnk_curation') = 'object'
-    AND NEW.attrs = json_remove(OLD.attrs, '$.__plurnk_curation')
-), 0) = 0
-BEGIN
-    SELECT RAISE(ABORT, 'log_entries attrs are immutable outside curation payload removal');
-END;
-
--- The engine may stamp an originating row exactly once. No later reassignment
--- can sever or counterfeit the occurrence identity.
-CREATE TRIGGER IF NOT EXISTS log_entries_ambient_event_once
-BEFORE UPDATE OF ambient_event_id ON log_entries
-WHEN NOT (OLD.ambient_event_id IS NULL AND NEW.ambient_event_id IS NOT NULL)
-BEGIN
-    SELECT RAISE(ABORT, 'log_entries ambient event identity may only be assigned once');
-END;
-
--- One relational projection owns activity eligibility, audience, and snapshot
--- shape for both immediately-final and proposal-settlement paths.
-CREATE VIEW IF NOT EXISTS ambient_activity_candidates AS
-SELECT *
-FROM (
-    SELECT w.workspace_id,
-           le.worker_id AS producer_worker_id,
-           -- {§env-delta-child-activity} — the runtime's own materialization (turn-0
-           -- initialization, doc-reconciliation maintenance, operation batches) is
-           -- private to the worker it serves and never crosses to the parent.
-           CASE
-               WHEN t.producer = '_plurnk' AND t.kind IN ('operation', 'initialization', 'maintenance') THEN NULL
-               ELSE w.parent_worker_id
-           END AS target_parent_worker_id,
-           CASE
-               WHEN le.state = 'resolved'
-                AND le.status_rx BETWEEN 200 AND 399
-                AND le.status_rx != 304
-                AND (
-                    (
-                        le.op IN ('EDIT', 'KILL')
-                        AND le.scheme = 'worker'
-                        AND le.hostname IS NULL
-                        AND le.pathname IS NOT NULL
-                    )
-                    OR (
-                        le.op IN ('COPY', 'MOVE')
-                        AND json_valid(le.rx)
-                        AND EXISTS (
-                            SELECT 1 FROM json_each(le.rx, '$.effects') effect
-                            WHERE json_type(effect.value) = 'object'
-                              AND substr(CAST(json_extract(effect.value, '$.target') AS TEXT), 1, 10) = 'worker:///'
-                        )
-                    )
-                )
-               THEN 1 ELSE 0
-           END AS workspace_broadcast,
-           le.id AS source_record_id,
-           le.at,
-           le.source,
-           le.op,
-           le.delimiter,
-           le.signal,
-           le.scheme,
-           le.username,
-           le.password,
-           le.hostname,
-           le.port,
-           le.pathname,
-           le.query,
-           le.fragment,
-           le.lineMarker AS line_marker,
-           le.tx,
-           le.mimetype_tx,
-           le.rx,
-           le.mimetype_rx,
-           le.status_rx,
-           le.state,
-           le.outcome,
-           json_remove(le.attrs, '$.__plurnk_curation') AS attrs
-    FROM log_entries le
-    JOIN workers w ON w.id = le.worker_id
-    JOIN loops l ON l.id = le.loop_id
-    JOIN turns t ON t.id = le.turn_id
-    WHERE le.ambient_event_id IS NULL
-      AND le.inherited_history = 0
-      AND le.op IS NOT NULL
-      AND le.state != 'proposed'
-      AND NOT (
-          le.op = 'SEND'
-          AND le.scheme IS NULL
-          AND l.status IN (200, 413, 429, 499, 500, 504, 508)
-      )
-) candidate
-WHERE target_parent_worker_id IS NOT NULL OR workspace_broadcast = 1;
-
--- Every final op-bearing child row is parent activity. A successful operation
--- whose landed effects touch worker:/// additionally acquires the workspace
--- audience. Observer rows and copied fork history cannot republish themselves.
-CREATE TRIGGER IF NOT EXISTS log_entries_append_ambient_event_insert
-AFTER INSERT ON log_entries
-WHEN NEW.state != 'proposed'
-BEGIN
-    INSERT INTO ambient_events (
-        workspace_id, producer_worker_id, target_parent_worker_id,
-        workspace_broadcast, kind, source_record_id, at, source,
-        op, delimiter, signal,
-        scheme, username, password, hostname, port, pathname, query, fragment,
-        line_marker, tx, mimetype_tx, rx, mimetype_rx, status_rx,
-        state, outcome, attrs
-    )
-    SELECT workspace_id, producer_worker_id, target_parent_worker_id,
-           workspace_broadcast, 'activity', source_record_id, at, source,
-           op, delimiter, signal,
-           scheme, username, password, hostname, port, pathname, query, fragment,
-           line_marker, tx, mimetype_tx, rx, mimetype_rx, status_rx,
-           state, outcome, attrs
-    FROM ambient_activity_candidates
-    WHERE source_record_id = NEW.id;
-
-    UPDATE log_entries
-    SET ambient_event_id = (
-        SELECT id FROM ambient_events
-        WHERE producer_worker_id = NEW.worker_id
-          AND kind = 'activity'
-          AND source_record_id = NEW.id
-    )
-    WHERE id = NEW.id
-      AND EXISTS (
-          SELECT 1 FROM ambient_events
-          WHERE producer_worker_id = NEW.worker_id
-            AND kind = 'activity'
-            AND source_record_id = NEW.id
-      );
-END;
-
--- A proposed operation becomes activity only when its lifecycle settles.
-CREATE TRIGGER IF NOT EXISTS log_entries_append_ambient_event_resolve
-AFTER UPDATE OF state, status_rx, rx, outcome ON log_entries
-WHEN OLD.state = 'proposed' AND NEW.state != 'proposed'
-BEGIN
-    INSERT INTO ambient_events (
-        workspace_id, producer_worker_id, target_parent_worker_id,
-        workspace_broadcast, kind, source_record_id, at, source,
-        op, delimiter, signal,
-        scheme, username, password, hostname, port, pathname, query, fragment,
-        line_marker, tx, mimetype_tx, rx, mimetype_rx, status_rx,
-        state, outcome, attrs
-    )
-    SELECT workspace_id, producer_worker_id, target_parent_worker_id,
-           workspace_broadcast, 'activity', source_record_id, at, source,
-           op, delimiter, signal,
-           scheme, username, password, hostname, port, pathname, query, fragment,
-           line_marker, tx, mimetype_tx, rx, mimetype_rx, status_rx,
-           state, outcome, attrs
-    FROM ambient_activity_candidates
-    WHERE source_record_id = NEW.id;
-
-    UPDATE log_entries
-    SET ambient_event_id = (
-        SELECT id FROM ambient_events
-        WHERE producer_worker_id = NEW.worker_id
-          AND kind = 'activity'
-          AND source_record_id = NEW.id
-    )
-    WHERE id = NEW.id
-      AND EXISTS (
-          SELECT 1 FROM ambient_events
-          WHERE producer_worker_id = NEW.worker_id
-            AND kind = 'activity'
-            AND source_record_id = NEW.id
-      );
-END;
-
--- {§client-interactions}: the durable discoverable half of a client-owned
--- interaction. The process-local lifecycle owner holds the awaiting callable;
--- this row holds only presentation and routing facts. Settlement deletes the
--- row, so client response payloads and owner-private continuation state are
--- never copied into persistence.
-CREATE TABLE IF NOT EXISTS client_interactions (
-    id           INTEGER NOT NULL PRIMARY KEY,
-    worker_id    INTEGER NOT NULL,
-    loop_id      INTEGER NOT NULL,
-    turn_id      INTEGER NOT NULL,
-    request      TEXT    NOT NULL CHECK (json_valid(request) AND json_type(request) = 'object'),
-    created_at   TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    FOREIGN KEY (worker_id) REFERENCES workers(id) ON DELETE CASCADE,
-    FOREIGN KEY (loop_id)   REFERENCES loops(id)   ON DELETE CASCADE,
-    FOREIGN KEY (turn_id)   REFERENCES turns(id)   ON DELETE CASCADE
-) STRICT;
-
-CREATE INDEX IF NOT EXISTS client_interactions_worker_id_id
-    ON client_interactions (worker_id, id);
-
--- subscriptions
--- Durable subscription lifecycle per SPEC {§subscriptions}. The row records what
--- the worker holds and routes cancellation to a separate process-local callable;
--- it never serializes that callable. Closed rows persist for forensics; partial
--- unique index enforces one active subscription per entry. The composite
--- foreign key makes that entry part of the subscribing Worker's own space.
-CREATE TABLE IF NOT EXISTS subscriptions (
-    id           INTEGER NOT NULL PRIMARY KEY,
-    version      INTEGER NOT NULL DEFAULT 0 CHECK (version >= 0),
-    worker_id       INTEGER NOT NULL,
-    entry_id     INTEGER NOT NULL,
-    scheme       TEXT    NOT NULL CHECK (length(scheme) > 0),
-    handle       TEXT    NOT NULL CHECK (length(handle) > 0),
-    published_channel TEXT          CHECK (published_channel IS NULL OR length(published_channel) > 0),
-    opened_at    TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    -- EXEC `<T,P>` poll policy: NULL = default backoff, 0 = disabled, positive = fixed cadence.
-    -- While the owning loop hibernates (202), an armed policy wakes it to inspect the stream ({§exec-poll}).
-    poll_seconds INTEGER          CHECK (poll_seconds IS NULL OR poll_seconds >= 0),
-    -- EXEC `<0>` — turn-scoped: the stream is reaped at the worker's next pre-turn so it never survives
-    -- into the subsequent turn; its terminal output surfaces initially visible like any conclusion. {§exec-poll}
-    turn_scoped  INTEGER NOT NULL DEFAULT 0 CHECK (turn_scoped IN (0, 1)),
-    closed_at    TEXT,
-    close_status INTEGER          CHECK (close_status IS NULL OR (close_status BETWEEN 100 AND 599)),
-    close_result TEXT             CHECK (close_result IS NULL OR json_valid(close_result)),
-    channel_results TEXT          CHECK (channel_results IS NULL OR json_valid(channel_results)),
-    CHECK ((closed_at IS NULL AND close_status IS NULL AND close_result IS NULL AND channel_results IS NULL)
-        OR (closed_at IS NOT NULL AND close_status IS NOT NULL AND close_result IS NOT NULL AND channel_results IS NOT NULL)),
-    FOREIGN KEY (worker_id) REFERENCES workers(id) ON DELETE CASCADE,
-    FOREIGN KEY (entry_id, worker_id) REFERENCES entries(id, owner_id) ON DELETE CASCADE
-) STRICT;
-
-CREATE UNIQUE INDEX IF NOT EXISTS subscriptions_active_one_per_entry
-    ON subscriptions (entry_id)
-    WHERE closed_at IS NULL;
-
-CREATE INDEX IF NOT EXISTS subscriptions_scheme_active
-    ON subscriptions (scheme)
-    WHERE closed_at IS NULL;
-
-CREATE INDEX IF NOT EXISTS subscriptions_opened_at ON subscriptions (opened_at);
-
-CREATE TRIGGER IF NOT EXISTS subscriptions_result_contract_insert
-BEFORE INSERT ON subscriptions
-WHEN NEW.closed_at IS NOT NULL
-  OR NEW.close_status IS NOT NULL
-  OR NEW.close_result IS NOT NULL
-  OR NEW.channel_results IS NOT NULL
-BEGIN
-    SELECT RAISE(ABORT, 'subscription must open before it can settle');
-END;
-
-CREATE TRIGGER IF NOT EXISTS subscriptions_result_contract_update
-BEFORE UPDATE OF closed_at, close_status, close_result, channel_results ON subscriptions
-WHEN NOT (
-    (NEW.closed_at IS NULL AND NEW.close_status IS NULL AND NEW.close_result IS NULL AND NEW.channel_results IS NULL)
-    OR (
-        NEW.closed_at IS NOT NULL
-        AND NEW.close_status IS NOT NULL
-        AND NEW.close_result IS NOT NULL
-        AND NEW.channel_results IS NOT NULL
-        AND json_valid(NEW.close_result)
-        AND json_valid(NEW.channel_results)
-        AND json_type(NEW.channel_results) = 'object'
-        AND json_type(NEW.close_result, '$.status') = 'integer'
-        AND json_extract(NEW.close_result, '$.status') = NEW.close_status
-        AND (
-            (NEW.close_status < 400 AND json_type(NEW.close_result, '$.problem') IS NULL)
-            OR (
-                NEW.close_status >= 400
-                AND json_type(NEW.close_result, '$.problem') = 'object'
-                AND json_extract(NEW.close_result, '$.problem.status') = NEW.close_status
-            )
-        )
-    )
-)
-BEGIN
-    SELECT RAISE(ABORT, 'subscription terminal result violates the operation-result contract');
-END;
-
--- A settlement may override the universal result for exact named channels.
--- Unknown channels and malformed results fail before the subscription or any
--- representation changes. The JS boundary additionally rejects projection
--- fields that are structurally unavailable in ChannelProducerResult.
-CREATE TRIGGER IF NOT EXISTS subscriptions_channel_results_contract
-BEFORE UPDATE OF closed_at, close_status, close_result, channel_results ON subscriptions
-WHEN NEW.closed_at IS NOT NULL AND (
-    EXISTS (
-        SELECT 1
-        FROM json_each(NEW.channel_results) AS channel_result
-        LEFT JOIN entry_channels ec
-          ON ec.entry_id = NEW.entry_id AND ec.name = channel_result.key
-        WHERE ec.name IS NULL
-           OR json_type(channel_result.value) != 'object'
-           OR json_type(channel_result.value, '$.status') != 'integer'
-           OR json_extract(channel_result.value, '$.status') NOT BETWEEN 200 AND 599
-           OR json_extract(channel_result.value, '$.status') = 202
-           OR (
-                json_extract(channel_result.value, '$.status') < 400
-                AND json_type(channel_result.value, '$.problem') IS NOT NULL
-           )
-           OR (
-                json_extract(channel_result.value, '$.status') >= 400
-                AND (
-                    json_type(channel_result.value, '$.problem') != 'object'
-                    OR json_extract(channel_result.value, '$.problem.status')
-                        != json_extract(channel_result.value, '$.status')
-                )
-           )
-    )
-)
-BEGIN
-    SELECT RAISE(ABORT, 'subscription channel result violates the channel producer contract');
-END;
-
--- Subscription settlement is the single atomic transition that closes the
--- lifecycle and installs current terminal producer evidence on every channel.
--- Overrides are exact; all other channels inherit the universal result.
-CREATE TRIGGER IF NOT EXISTS subscriptions_settle_channels
-AFTER UPDATE OF closed_at, close_status, close_result, channel_results ON subscriptions
-WHEN OLD.closed_at IS NULL AND NEW.closed_at IS NOT NULL
-BEGIN
-    UPDATE entry_channels
-    SET producer_result = COALESCE(
-            (
-                SELECT json(channel_result.value)
-                FROM json_each(NEW.channel_results) AS channel_result
-                WHERE channel_result.key = entry_channels.name
-            ),
-            NEW.close_result
-        ),
-        state = CASE WHEN json_extract(
-            COALESCE(
-                (
-                    SELECT json(channel_result.value)
-                    FROM json_each(NEW.channel_results) AS channel_result
-                    WHERE channel_result.key = entry_channels.name
-                ),
-                NEW.close_result
-            ),
-            '$.status'
-        ) >= 400 THEN 'errored' ELSE 'closed' END
-    WHERE entry_id = NEW.entry_id;
-END;
-
--- One durable publication cursor per selected subscription channel. Log rows
--- are curated model context and therefore cannot own this lifecycle fact.
--- The row survives KILLing any generated observation and disappears only with
--- its subscription. {§exec-stream}
-CREATE TABLE IF NOT EXISTS subscription_publications (
-    id                 INTEGER NOT NULL PRIMARY KEY,
-    version            INTEGER NOT NULL DEFAULT 0 CHECK (version >= 0),
-    subscription_id    INTEGER NOT NULL,
-    channel            TEXT    NOT NULL CHECK (length(channel) > 0),
-    published_end      INTEGER NOT NULL DEFAULT 0 CHECK (published_end >= 0),
-    terminal_published INTEGER NOT NULL DEFAULT 0 CHECK (terminal_published IN (0, 1)),
-    UNIQUE (subscription_id, channel),
-    FOREIGN KEY (subscription_id) REFERENCES subscriptions(id) ON DELETE CASCADE
-) STRICT;
-
-CREATE INDEX IF NOT EXISTS subscription_publications_pending
-    ON subscription_publications (subscription_id, terminal_published);
-
-CREATE TRIGGER IF NOT EXISTS subscriptions_seed_publications
-AFTER INSERT ON subscriptions
-BEGIN
-    INSERT INTO subscription_publications (subscription_id, channel)
-    SELECT NEW.id, ec.name
-    FROM entry_channels ec
-    WHERE ec.entry_id = NEW.entry_id
-      AND (NEW.published_channel IS NULL OR ec.name = NEW.published_channel);
-
-    SELECT CASE WHEN NOT EXISTS (
-        SELECT 1 FROM subscription_publications WHERE subscription_id = NEW.id
-    ) THEN RAISE(ABORT, 'subscription has no publishable channel') END;
-END;
-
--- The generated READ and its cursor transition are one SQLite statement. A
--- later log KILL removes evidence from active context without rewinding the
--- subscription/channel publication state. {§exec-stream}
-CREATE TRIGGER IF NOT EXISTS log_entries_advance_subscription_publication
-AFTER INSERT ON log_entries
-WHEN NEW.subscription_publication_id IS NOT NULL
-BEGIN
-    SELECT CASE WHEN
-        NEW.origin != '_plurnk'
-        OR NEW.op != 'READ'
-        OR json_type(NEW.attrs, '$.streamEnd') != 'integer'
-        OR json_extract(NEW.attrs, '$.streamEnd') < 0
-        OR json_type(NEW.attrs, '$.terminal') NOT IN ('true', 'false')
-    THEN RAISE(ABORT, 'subscription publication requires one canonical stream observation') END;
-
-    UPDATE subscription_publications
-    SET published_end = json_extract(NEW.attrs, '$.streamEnd'),
-        terminal_published = json_extract(NEW.attrs, '$.terminal'),
-        version = version + 1
-    WHERE id = NEW.subscription_publication_id
-      AND terminal_published = 0
-      AND (
-          (json_extract(NEW.attrs, '$.terminal') = 0
-              AND json_extract(NEW.attrs, '$.streamEnd') > published_end)
-          OR
-          (json_extract(NEW.attrs, '$.terminal') = 1
-              AND json_extract(NEW.attrs, '$.streamEnd') >= published_end)
-      );
-
-    SELECT CASE WHEN changes() != 1
-        THEN RAISE(ABORT, 'subscription publication transition is stale or already terminal')
-    END;
-END;
-
--- (worker_watermarks removed — {§env-delta} is now pull-from-log, no per-worker snapshot.)
-
--- workspace_constraints
--- SPEC {§membership} constraint overlay — explicit policy and the inspectable
--- exact pick produced by accepted file creation share one representation.
--- Per (workspace, effect, glob/target): `pick` (members git misses, resolved by a
--- targeted client-dictated scan), `hide` (drop git-tracked matches), `view` (member
--- for read; File.edit rejects the write). git-absent, `pick` rows are the sole substrate
--- source. Composed at membership resolution; node:path.matchesGlob.
-CREATE TABLE IF NOT EXISTS workspace_constraints (
-    workspace_id INTEGER NOT NULL,
-    -- include admits files git misses; exclude removes members — the members family's lexicon
-    -- ({§members-projection}). An inclusion is a pattern scan; a creation record is one exact path.
-    effect     TEXT    NOT NULL CHECK (effect IN ('include', 'exclude')),
-    glob       TEXT    NOT NULL,
-    -- create: the exact record of a file Plurnk wrote ({§fs-create-record}); members: a
-    -- human-authored definition projected by the members family; model: a definition the model
-    -- proposed under the members scope — never admitted past the repository's ignore rules.
-    source     TEXT    NOT NULL CHECK (source IN ('create', 'members', 'model')),
-    CHECK (source IN ('members', 'model') OR effect = 'include'),
-    PRIMARY KEY (workspace_id, effect, glob),
-    FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE
-) STRICT, WITHOUT ROWID;